LinuxQuestions.org
Register a domain and help support LQ
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices

Reply
 
Search this Thread
Old 12-01-2011, 03:32 PM   #1
B00Mshesaid
Member
 
Registered: Oct 2011
Distribution: Debian
Posts: 31

Rep: Reputation: Disabled
Looking for a deleted file


So I am looking for a file on hard drive I took out of a broken computer. I have scoured the drive with no success. I found a link to the file "Cri_me_Fi_le.txt.lnk." Using "$ strings" I found that the original text file was in My Documents but is no longer. I then used ntfsundelete to see if it had been deleted, more than 4000 files came up and after searching through the files none were my file. The file was actively hidden from me and the name may have changed slightly (I was told to look for "Crime file"). At this point, I have no idea what to do. Does anyone have any idea how I could locate this file?
 
Old 12-01-2011, 03:45 PM   #2
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
Basically when a file is deleted it's simply marked as available to be overwritten, the unused space on the disk is called slack space and there are several tools that can "carve" files from the slack space. It's safer to work on an image of the disk so try booting on a live cd and 'dd if=/dev/sda of=... bs=512' to an external drive.
 
Old 12-01-2011, 03:52 PM   #3
B00Mshesaid
Member
 
Registered: Oct 2011
Distribution: Debian
Posts: 31

Original Poster
Rep: Reputation: Disabled
I don't understand. I am using a IDE/SATA to USB cable. Should I still run from a cd?
 
Old 12-01-2011, 04:01 PM   #4
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
The point is not to perform any more writes to the target drive as this could reduce your chances of file recovery.
 
Old 12-01-2011, 04:13 PM   #5
B00Mshesaid
Member
 
Registered: Oct 2011
Distribution: Debian
Posts: 31

Original Poster
Rep: Reputation: Disabled
Ok, that makes sense. What about the command? I typed it in and basically froze my computer. Was is copying the entire drive?
 
Old 12-01-2011, 04:19 PM   #6
B00Mshesaid
Member
 
Registered: Oct 2011
Distribution: Debian
Posts: 31

Original Poster
Rep: Reputation: Disabled
Thanks for your help bro, I need to get off the computer tho. Thanks away.
 
  


Reply

Tags
homework, ntfsundelete, strings


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
How to recover a deleted file using the ext3 file system wdhpr Linux - Newbie 6 01-11-2011 10:04 PM
Deleted log file - how to get back via file descriptor and keep alive? prollocks Linux - General 1 05-29-2009 09:08 AM
Need help to recover Deleted file - (file was saved in doc) Pravab Ubuntu 2 08-17-2008 10:57 AM
Deleted File jasbhatti Linux - Newbie 7 05-03-2008 09:59 PM
Deleted file klmn1 Linux - Software 2 12-12-2003 06:04 AM


All times are GMT -5. The time now is 09:33 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration