Recover Previously Deleted File on an NTFS partition (even from Trash) on UBUNTU

Use “ntfsundelete”. A usefull way is to copy the output of its search in a file, like this


~/temp$ sudo ntfsundelete /dev/sda6 -S 10k-1m -p 100 --> list.txt


where sda6 is the drive of interest previously unmounted. Here we searched for files between 10kb and 1mb big, that are 100% recoverable. Then in the list we look for the inode number we are interested in (relative to the filename, size, etc), and to recover it we do


~/temp$ sudo ntfsundelete /dev/sda6 -u -i 1039 -o 33.txt -d ~/temp


1039 is the inode number, 33.txt is the output number and ~/temp is the output folder.