8.2. TestDisk: undelete file for NTFS

8.2.1. Start TestDisk

8.2.2. Log creation

Choose Create unless you have a reason to append data to the log or if you execute TestDisk from read only media and can’t create it elsewhere.

Press Enter to proceed.

8.2.3. Disk selection

All hard drives should be detected and listed with the correct size by TestDisk.

Use up/down arrow keys to select your hard drive with the lost partition/s.

Press Enter to Proceed.

macOS If available, use raw device /dev/rdisk* instead of /dev/disk* for faster data transfer.

8.2.4. Partition table type selection

TestDisk displays the partition table types.

Select the partition table type - usually the default value is the correct one as TestDisk auto-detects the partition table type.
Press Enter to Proceed.

8.2.5. Start the undelete process

Select Advanced

Select the partition that was holding the lost files and choose Undelete

8.2.6. NTFS file undelete

TestDisk scans MFT entries for deleted files. A list of NTFS deleted files found by TestDisk is displayed

To recover a single file, highlight the file and press ‘c’ (lowercase) to copy it.
To recover a several files, move the first file you want to recover, press ‘:’ to select it, repeat the process for the others files, press ‘C’ (uppercase) to copy them

It’s not visible in interface but it’s possible to filter the results, press ‘f’ to add a filter. Several filters can be added. To cancel all the filters, press ‘r’ (reset).

8.2.7. Select where recovered files should be written

Select the destination

8.2.8. File recovery is completed

When the NTFS file recovery is finished, choose Quit to exit.

If TestDisk has been unable to find your lost data, try PhotoRec instead.