Any way to restore files deleted by windows ?

[Lancelot]

I'm using Linux Mint 20.3 cinnamon.
I've 2 internal HDDs of 500GB each.
Mint is installed on sda5, and windows 8.1 is on sda6.

I have my files on 2nd hdd --> sdb6 and sdb7 [both are in NTFS format]

While I was using mint, I checked that all of my files are their on sdb6 & sdb7.

I unmounted those drives (sdb6 & sdb7).

Booted Win 8.1.
Checked my files on sdb6 and sdb7.

sdb6 -- 5-6 folders which contained images & videos were deleted [~150GB]

sdb7-- 2 folders which contained videos and music files were deleted [~100GB]

Turned off win8.1 & booted on linux mint
The files mentioned above were missing when opened with Nemo. Checked with CLI and same result- files are missing

But when I checked with GParted, it is showing that the disk is full. Considering windows somehow deleted files of size 100 GB, the free space on disk should've increased but it's same before deleting.

This gave me hope that the files may be somewhere I can't find.

Question: Can I restore those files ?

[djph]

If the disks are still showing usage, it might be that they files (etc) are in a trash directory ("recycle bin" in windows?)


attempting to recover deleted files with something like photorec or testdisk might be possible, but it's a longshot.

Honestly, the best way to recover accidentally deleted files is restoration from backup ...


Aside -- you did REMOUNT them, right? You're not just thinking the data is missing because the partitions simply weren't remounted in Linux?

[karlchen]

Hello, Lancelot.

You might use a tool like e.g. photorec on Linux side in order to identify the deleted folders and files and restore them.
You might also use a corresponding tool on the Windows side in order to identify the deleted folders and files and restore them.

I wonder a bit whether the folder names, which you had still seen on Linux side, before they disappeared when booted into Windows, may have had characters, which can be used inside folder and filenames on Linux sie, but not on Windows side?

This once happened to me when I saved a file on an NTFS partition, which had a colon : in its filename. Linux did not complain. Windows never displayed the file. And when doing a chkdsk on the NTFS partition from Windows side, Windows considered the file a lost cluster and converted it into a "found0001.something" file. This was when my naming mistake occured to me.

Karl

[axrusar]

A few more suggestions..

1. Do image the mentioned partitions with missing folders/files to an external drive. So you can play over and over again in case you make mistakes.
2. Do not mount these partitions in windows anymore. Any single write operation on them can destroy the files you are looking for.
3. You can use Hiren's bootCD, it has many recovery utilities, you just need that 3rd disk to recover the files to. https://www.hirensbootcd.org/download/
If the files were deleted or really messed up, the recovery will bring files back but you may lose the filenames, folders and structure of the files, so try first to find them. They are not hidden right?