Using Linux to Recover Deleted Files

[bostonman]

I have an old Windows formatted hard drive (files only, no OS) with many deleted files, and I want to restore them to find a few long lost files by connecting it via a USB to IDE cable.

I know that if I've written to the hard drive since deleting them that the deleted files are most likely deleted forever.

In any case, a quick search on the Internet and I found a few Linux commands that I could use, but I was wondering if anyone had any particular one they find most effective.

[BradC]

It depends greatly on what the filesystem is.
I've had great results in the past with testdisk and photorec.

[bostonman]

I thought stating it was an old Windows formatted hard drive was adequate.

Would an XP formatted hard drive be a FAT32? If so, that is the file system.

I have a Windows program that searches for deleted files, but it seems Linux has better tools for stuff like this.

[coromonadalix]

You have many  Windows PE  (Usb bootable)  recovery sytems  with tons of tools

Hiren's BootCD
Gandalf Pe ...   
Strelec ...

The most important thing is not to write anything on the drive needed to be recovered,  you use an external computer, and recovery software


https://www.makeuseof.com/tag/5-best-rescue-disks-windows-system-restore/

[rdl]

If it is an XP disk then probably it uses NTFS. If you have it in a Windows machine the easiest way to tell is right click on the drive in Windows Explorer and choose "Properties". The file system will be shown there. For undeleting files I have always used Recuva, but it's Windows only.

[magic]

For NTFS there is ntfsundelete in the ntfs-3g package. It works and it perfectly undeletes every file which has not been overwritten yet (either data or metadata).

Given my vague recollection of how FAT32 works, I'm not entirely sure if the same is even possible there at all.

There are "file carving" programs like photorec which simply scan the whole disk sector by sector and look for something that resembles a JPG file, MP3, DOC or anything. You can forget about recovering the original file name, location in the directory tree, etc.