If you find yourself in a situation where you need to restore deleted files (formerly this procedure called ‘unerase’) from a Windows ntfs partition, but are unable to boot from it, the simplest solution is to use a Linux LiveCD. This will require the ntfsundelete utility which is bundled with most LiveCDs.

The most popular LiveCD for this task today is Ubuntu. We recommend using its lightweight variant Lubuntu, which you can always freely download here.

Burn the LiveCD iso image to an USB stick, boot from it, open a terminal (CTRL+ALT+T) and type the command:

sudo fdisk -l

This will show you the actual name of the partition you want to recover your deleted files from. Alternatively, you can use the graphical gparted utility, which you can load with the command:

sudo gparted

Let’s say the partition you want to recover files from is /dev/sda1 (formerly “drive C” in Windows). By entering the command:

sudo ntfsundelete /dev/sda1

– you will get a list of deleted files available for recovery.

Navigate to the folder where you want to restore the files using the cd command. And you’re ready to:

sudo ntfsundelete /dev/sda1 –u –m *.jpg

– will restore all deleted files with jpg extension.

sudo ntfsundelete /dev/sda1 –u –m Inode

– where Inode is the numeric value of the individual file you want to recover (these values appear in the first column of the list of files available for recovery).

You can change the ownership of recovered files by using the chown command. So, for example, you can change the owner of all files in the directory to the user lubuntu:

sudo chown lubuntu *