Understanding undeleted files
Posted: 03 Jan 2024, 19:23
Hello,
I am running Ubuntu 22.04 in dual boot with Windows 11. I very stupidly completely deleted all the files in my Windows NTFS system partition totaling around 50 GB (including packages installed under Windows but happily not my user data which is in another partition). I would very much like to undelete these files and insert them in the original directory hierarchy, in order to avoid having to completely reinstall Windows and Ubuntu.
I have tested the testdisk file undelete functionality on a sample of the deleted content (about 1GB containing around 1500 files). It seems to work very well but instead of my original structure of directories and files I get:
* about 650 files with names in the form $$DeleteMe[filename][32 character hex number]
* a directory called $Extend/$Deleted with sub-directories whose names are 24-character hex numbers, each containing one or more apparently well formed files with correct filenames, and also a few files whose filenames are 24-character hex numbers and whose content is unclear (a total in both categories of about 750 files).
At least in this sample, there is no clear information on directory names and relationships (perhaps coded in the hex numbers?). In order to use this output to regenerate my file structure I have to understand the above data which hopefully has all of the original content. Could someone help me in understanding the testdisk output?
Thanks and best regards, John
I am running Ubuntu 22.04 in dual boot with Windows 11. I very stupidly completely deleted all the files in my Windows NTFS system partition totaling around 50 GB (including packages installed under Windows but happily not my user data which is in another partition). I would very much like to undelete these files and insert them in the original directory hierarchy, in order to avoid having to completely reinstall Windows and Ubuntu.
I have tested the testdisk file undelete functionality on a sample of the deleted content (about 1GB containing around 1500 files). It seems to work very well but instead of my original structure of directories and files I get:
* about 650 files with names in the form $$DeleteMe[filename][32 character hex number]
* a directory called $Extend/$Deleted with sub-directories whose names are 24-character hex numbers, each containing one or more apparently well formed files with correct filenames, and also a few files whose filenames are 24-character hex numbers and whose content is unclear (a total in both categories of about 750 files).
At least in this sample, there is no clear information on directory names and relationships (perhaps coded in the hex numbers?). In order to use this output to regenerate my file structure I have to understand the above data which hopefully has all of the original content. Could someone help me in understanding the testdisk output?
Thanks and best regards, John