We help IT Professionals succeed at work.

Undelete old NTFS data...

turtletimer asked
Medium Priority
Last Modified: 2008-01-09
I had some old music that I created on a hard drive.  It's not really that important to me, but I'd like to try and get it back.  It was sitting in my closet for 3 years and I need a drive for a web server dev box, so I used it.

Now I want to try and recover any of it.  The linux install I did on it was small and not much writing occured to the drive besides the initial install.  It is formatted as ext3 now.

Is there any program that is bootable and could try and find old ntfs stuff in there? Is everything that was NTFS definatley gone now that I formatted it as ext3?

Like I said it's not important, but I'd like to try.  Give me anything you got...
Watch Question

Technology and Business Process Advisor
Most Valuable Expert 2013
I'd suggest if you're serious about it, try Ontrack's software - www.ontrack.com

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Knoppix should have ntfsundelete:


Try something like:

    ntfsundelete --scan /dev/hda 2>&1 | tee scan.out

And if it finds any files, maybe try something like:

    ntfsundelete --undelete  --match "*.mp3" --destination /path/to/alternate/storage

Where /path/to/alternate/storage is a place where you have mounted a partition on a different disk.  Your alternate storage must contain a filesystem writable by Linux, so that leaves you with FAT32 if it must be readable in Winders.
  With all due respect to leew and his recommendation ( Ontrack data recovery services) I would say your files - residing on previously NTFS formatted partition- are definitely gone for good. Formatting hard-disk with ext3  destroys all data stored on disk partitions and
undo is  impossible. Your data are destroyed first by patition type conversion ( NTFS --> ext3)  and then overwritten by Linux
operating system, libraries and applications files.
   Ontrack data recovery service guys might have some wizardry hidden in their sleeves but then you have to swallow charges that will occur and I dont think you'd be happy with that.

good luck
Lee W, MVPTechnology and Business Process Advisor
Most Valuable Expert 2013

I disagree.  When I've formatted Extx file systems, I've not seen them do anything destructive to the data.  I'm not saying you'll definitely get the data back, but if it's recoverable without extreme measures, I think ontrack will recover it.

ntfsundelete - recovers deleted files from an NTFS volume.
As I understand turtletimer has no NTFS partition(s) anymore.
Am I wrong?
> As I understand turtletimer has no NTFS partition(s) anymore.

He more than likely still has NTFS file system structures on his disk.   I am not sure if ntfsundelete requires that partition be otherwise intact, as I've never used it before, but it is feasible to search for these structures and recover the data.


The whole partition has been formatted to ext3...

What do you guys think?
The type of file system does not really matter.  None completely overwrite every sector of the disk (and I would guess that none even have an option for doing so).  They only overwrite what they need.
Ok, I had to check the man pages.   If use "-c -c" with mke2fs/mkfs.ext3/etc. it'll destroy all the data, but who does that?
"Deleting" data isn't a very technically correct term. When you remove files from a magnetic hard disk, the hard disk retains some of the magnetism, which is what is used by most file recovery programs to recover scraps of data. Every file system has a way of indexing the different files on the hard disk so it can protect those sectors of the hard disk from randomly being overwritten; you've lost the index, you just have to manually go through the magnetised sectors to find the headers of the files you want to recover and hopefully some of the file's contents will follow.

What you can recover is also a factor of when the NTFS data was "erased". Usually recovery is possible immediately after deletion. The inital install of your distro might not have overwritted all the sectors on the hard disk with 0s and 1s, like an NTFS or FAT format does. So the data is theoritically recoverable. But with this new filesystem (data recovery software writers don't necessarily support this) and other practical problems of not having windoze, you're also missing out popular software created exclusively for windoze.

It might be too hard to recover the files you deleted imho and you'd probably be wasting time trying to recover small clips of mp3 data and patching it. Think about it- What can data recovery do? It can only recover "scraps" of data since the hard disk hasn't indexed that space and may randomly write to it. It's very unlikely that you'll get even one of your mp3 back intact. Now that's only worth the trouble if you're recovering some really important documents and don't mind if they're filled with junk in the middle and are incomplete- You can always fix that. But you're thinking about recovering music- Would you really like to listen to incomplete, broken, low-quality music? IMHO, you should only recover that music if it means something else to you- ie. you don't just want to listen to it.


What's with this Ontrack? Have a look at their page (http://www.ontrack.com/easyrecoveryprofessional/) for system requirements:

Operating Systems

    * Windows® 98SE & Windows Me
    * Windows® 2000, Windows NT® & Windows XP

File Repair capabilities for:

    * Microsoft Outlook 97, 2000, XP and 2003 (PST & OST)
    * Microsoft Outlook Express 5.0, 5.01, 5.5 and v6.0 (DBX)
    * Microsoft® Word (DOC)
    * Microsoft® Excel (XLS)
    * Microsoft® Access Database (MDB)
    * Microsoft® PowerPoint® (PPT)
    * Zip archive files (ZIP)

You don't run windoze and want to recover mp3s. What do you want to achieve with Ontrack?

ntfsundelete isn't any better:

ntfsundelete cannot perform the impossible.

When a file is deleted the MFT Record is marked as not in use and the bitmap representing the disk usage is updated. If the power isn’t turned off immediately, the free space, where the file used to live, may become overwritten. Worse, the MFT Record may be reused for another file. If this happens it is impossible to tell where the file was on disk.

Even if all the clusters of a file are not in use, there is no guarantee that they haven’t been overwritten by some short-lived file.

You don't even have the Master File Table. Besides, I seriously doubt if it can accept an ext3 disk as an argument.


dbruntonQuid, Me Anxius Sum?  Illegitimi non carborundum.
These guys


have utils for recovering data.  You can try the demo version for free and see if it'll handle your disk and find and NTFS files for you.

No bets though.
Top Expert 2006
If you don't try, then you'll never know. With respect to trying to recover data from this type of scenario, I think that for many of the reasons already mentioned, there is a chance that some of the data from the NTFS partition will be recoverable. I don't know how much, as I haven't dealt with quite this set of circumstances before. I have a reasonable degree of experience in 'real' data recovery of commercial servers, and carry out one or two data recovery jobs a month.

Approach that I would use for this drive would be:

1.  Stop using it immediately.
2.  Mount the drive into a test rig which has at least twice the capacity of the drive being recovered.
3.  In this particular case, the software I would use would be Zero Assumption Recovery:


Has an initial scan and image mode in order to give you an idea of what can be recovered.
4.  Run the scan/image/index process. This can take up to 2 days for a 60GB drive on a 2GHz system. It takes a **long** time!
5.  If it shows that the files are recoverable, then you can purchase the licence. The original indexing file can be used in order to save you having to rescan the drive!

Be aware that the software may say that afile.txt is recoverable, and in fact it will recover 3 or 4 versions of the file, which are previous iterations of the file that you've saved (hence me saying that you need at least twice the capacity of spare drive to that being recovered).

Yo can also find that you get files that have been overwritten, but the 'next sector' links on the drive point into a valid file, and hence you'll end up with chamaeleon files that are part of 2 or more files once recovered. You then need to check which files are really what you want.

If ZAR can't recover it, then the only options available to you are the specialist forensic labs...and you will definitely not like the prices £3000+ for a 40GB is not unreasonable, but they are impressive with some of the things that they can do.

Why not try a program like GetDataBack ?

The Trial download is free, but will only show you what you can recover, it won't actually recover the data.
(no need to buy, if you can't recover anything I guess.)

Top Expert 2006

This is a superb scenario, and technically interesting - I'd welcome information from anyone else as to the exact workings or internal knowledge of these pieces of software. Process carried out was as follows:

1.    Install NTFS partition with Windows 2K professional on old 8GB drive. - Had this lying around.
2.    Delete partition, and replace it with single ext3 / partition and installed puppy linux (Deliberately a small distribution)
3.    Took image using R-Drive Image 3.0.
4.    Drive inserted in test setup. Tried recovery.

I can't get ntfsundelete to work at all in this case, as it is no longer an ntfs file system - I'd welcome anyone else's solution to this, because even after changing the partition table back, it still didn't recognise the partition correctly. I'm wondering if the swap (500MB - deliberately at the end of the drive) is confusing it?

GetDataBack works (but you have to change the partition to be an ntfs one again otherwise it refuses to run on the partition - another write!...but I can get it to work.), but only appears to work if the first block of the file concerned still exists. If the first block of the file is gone, then none of the file is recovered. File recovery from first block seems to continue until a block is missing. Therefore potentially useful.

Zero Assumption Recovery will recover block chains after a missing block, and will also recover old versions of the same file. A little overkill in  that you might end up checking 4-5 copies of a file with the same name in order to find the 'best' one (or most up to date). Had to delete the partition table in order to get this software to behave sensibly. I.e, it takes longer and more work to carry out the recovery, but in my opinion does a more thorough job. Most interestingly, after deleting the partition tables completely, on recovery, it decided that there must have been 2 partitions and did a complete recovery of the puppy linux, and also shed loads of Windows 2K files. Worth noting that the original drive had been in production use for a fair amount of time. Ignoring the puppy linux files, I've got a lot more files recovered with this, but there are loads of 'duplicates', but for some text based files I've got partial recovery where GetDataBack recovered nothing.

Final thoughts are that the individual is trying to recover MP3 files, which they probably only want if they are complete? In which case, GetDataBack is probably the best option if it works at all, followed by ZAR.


Top Expert 2006

If you want the full number of files recovered statistics, you'll have to wait until tomorrow!.....:).....but the above information gives the idea.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.


Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.