So, i will be doing this under linux for a good reason
My friend gave me his computer so that i can recover everything for him, he deleted all the photos and so many other things, photos of his family are most important to him.
So, becuase i have been holding his computer hostage for a week now, i decided to copy the entier hard drive so i can give him his computer back, and extract everything at my convinience, so after mountingf the disk i want to undelete from… i executed the command.
ddrescue /dev/sdb /hds/3tb/200gb.img /root/resumelog.log
So i had the image file that i can use for recovery after mounting
Now if as in the article here http://www.buildingcubes.com/2012/07/27/rescuing-a-failed-hard-drive/ i mounted the drive, i can use a nice linux command (ntfsundelete) to undelete the files from the mounted partition.
1- create a list of files to take a look at, put all deleted JPGs in a text file
ntfsundelete /hds/img -m ‘*.jpg’ -p 80 -t 8m > deletedmp3.txt
ntfsundelete /dev/loop0 -m ‘*.zip’ -p 50 -t 8m > deletedjpg.txt
2- change to the directory where you want to recover files to
cd /hds/wd1tb/newdir
3- recover all PNG files then all jpg files
ntfsundelete /dev/sda1 –u –m *.png
ntfsundelete /dev/sda1 –u –m *.jpg
or if i want to move them to a directory other than the active directory
ntfsundelete /dev/sda1 -u -m ‘*.jpg’ -p 90 -t 8m -d /hds/wd1tb/newdir
-p 90 means only recover files with at least 90% recoverable content
-t 5m means only files deleted in the past 8 months