If it is deleted in the linux graphical interface, it is generally selected to be thrown into the recycle bin.
If it is deleted using the rm command, there is no more, and the recovery is not very good.
Preliminary preparation: first look at my partition (cmd: df -h)
/dev/sda3 29G 5.2G 23G 19% /
udev 998M 4.0K 998M 1% /dev
tmpfs 402M 1.2M 401M 1% /run
none 5.0M 0 5.0M 0% /run/lock
none 1005M 152K 1005M 1% /run/shm
/dev/sda5 86G 49G 38G 57% /media/585347FF33462D24
------------------- -------------------------------------------------- -------------------------------------------------- ----
1. Install the ntfsprogs package
cmd: sudo apt-get install ntfsprogs
2. Uninstall the NTFS partition where the files were deleted by mistake
cmd: umount /dev/sda5
3. Check the files I deleted in the last 2 days
cmd: ntfsundelete /dev/sda5 -t 2d
prompts
Inode Flags %age Date Size Filename
---------------------------------------------------------------
1093 FN.. 100% 2013-07-26 8768 speedmem2.hg-journal
1129 FR.. 100% 2013-07-26 70 ExcInfo.ini
10785 FR.. 100% 2013-07-26 512 wcachedb.db-journal
49753 D... 0% 2013-07-26 0 20130624
55293 FR.. 100% 2013-07-26 75 ~TA515B.tmp
56132 FN.. 0% 2013-07-26 3859 ~EFF.tmp
56136 FN.. 100% 2013-07-26 2542 ~CD02.tmp
56139 FN.. 100% 2013-07-26 4824 ~DCEA.tmp
56141 FN.. 100% 2013-07-26 24355 ~E516.tmp
56143 FR.. 100% 2013-07-26 365 ~EDBE.tmp.trt
56148 D... 0% 2013-07-26 0 2070
56152 D... 0% 2013-07-26 0 3076
56156 D... 0% 2013-07-26 0 3082
56160 D... 0% 2013-07-26 0 Graphics
56176 FN.. 0% 2013- 07-26 788 $shtdwn$.req
56192 FN.. 0% 2013-07-26 2390 ~TAFF39.tmp
56193 FN.. 0% 2013-07-26 1337 ~TA3917.tmp
56196 FN.. 100% 2013-07 -26 3127 ~TA2A73.tmp
56203 FN.. 100% 2013-07-26 4640 SoftMgrM.db-journal
56204 FN.. 0% 2013-07-26 2576 speedmem2.hg-journal
Files with potentially recoverable content: 10
Note: The above shows that I have 10 deleted files that can be recovered. Observe the deletion date and size and find that the one with Inode of 1903 is the file I accidentally deleted.
4. The last step, recover the file
code: ntfsundelete /dev/sda5 -u -i 1093 -d /home/tina
A prompt appears:
Inode Flags %age Date Size Filename
---------------------------------------- -----------------------
1093 FN.. 0% 2013-07-26 8768 speedmem2.hg-journal
Undeleted 'speedmem2.hg-journal' successfully.
In this way, my files are restored to the /home/tina folder, and the name is speedmem2.hg-journal
---------------------------------------- -------------------------------------------------- -------------------------------------------------- ------------
Can't open it with gedit, change vim, open it, but it's a random horse, delete some strange ＠＠＠＠＠＠＠＠＠, save it, and use it again gedit can actually be opened, and most of the things are there.
-------------------------------------------------- -------------------------------------------------- ---------------------------------------
Backup NTFS partitions with ntfsprogs: http://www .linuxsir.org/bbs/printthread.php?p=1466533
Wiki related to file recovery in linux:
http://wiki.ubuntu.org.cn/index.php?title=UbuntuHelp:DataRecovery/zh&diff=prev&oldid=76543 http://www.ubuntugeek.com/recover-deleted-files- with-foremostscalpel-in-ubuntu.html