4

I need to restore some files deleted from pratition.

ben@ben-V5-171:~$ sudo ntfsundelete /dev/sdb1
Access is denied because the NTFS volume is already exclusively opened.
The volume may be already mounted, or another software may use it which
could be identified for example by the help of the 'fuser' command.
You can use force option to avoid this check, but this is not recommended
and may lead to data corruption.
ben@ben-V5-171:~$ fuser /dev/sdb1
ben@ben-V5-171:~$ sudo fuser /dev/sdb1
ben@ben-V5-171:~$ lsof /dev/sdb1
ben@ben-V5-171:~$ sudo lsof /dev/sdb1
lsof: WARNING: can't stat() fuse.gvfs-fuse-daemon file system /home/ben/.gvfs
      Output information may be incomplete.
ben@ben-V5-171:~$
Thomas Ward
  • 72,494
  • 30
  • 173
  • 237
MInner
  • 383
  • 1
  • 4
  • 16
  • Is that a solution to your question? If so please make it an ANSWER and accept it. That way we all know it got solved and the automatic system will not keep kicking it to the frontpage. – Rinzwind Jan 27 '14 at 08:13

1 Answers1

0

I had to manually umount my drive. It turned to be vfat fs, so finaly, the best way to restore files in my situation was this one:

ben@ben-V5-171:~/tmp/flash$ sudo dd if=/dev/sdb1 of=fl.img bs=1024
ben@ben-V5-171:~/tmp/flash$ tsk_recover -e fl.img files/
MInner
  • 383
  • 1
  • 4
  • 16