# Reading deleted files from NTFS



## Seeker (Mar 22, 2013)

After I RO 
	
	



```
# mount -t ntfs ...
```
How can I via /usr/bin/find, list recently deleted files (deleted via *shift+del* under windows, so those aren't in Recycle Bin)


----------



## SirDice (Mar 22, 2013)

You can't. You'll need specific software to scan the disk to find any deleted files.

http://whereismydata.wordpress.com/2009/05/02/forensics-what-happens-when-files-are-deleted/


----------



## bkouhi (Mar 22, 2013)

As far as I know, you can't do it via find(1)(). If you want to recover your files, you may try your luck with sysutils/testdisk. testdisk is a powerful and easy to use data recovering tool. Here is a step by step tutorial. Please don't write anything on that partition.


----------



## Seeker (Mar 22, 2013)

The point is, I want to do it from/within FreeBSD. (Under Win, I use Restoration 3.2.13)
I'll use sysutils/testdisk, as it supports NTFS partitions since version 6.11

Worry not, as:

```
# mount -t ntfs ...
```
Doesn't allow any kind of write.

Thx for advices crew! 

PS: I haven't lost any files, just want to learn something new.


----------



## zspider (Mar 22, 2013)

Put the drive in a housing, `dd` an image of the drive to an iso, then run a program that lets you recover from the ISO, like UFS Explorer(supports NTFS too). That's how I recovered my accidentally deleted files from FreeBSD 3 years ago.


----------

