I accidentally deleted some "important" files from an NTFS volume and tried using `ntfsundelete` to recover them. The command I ran was `ntfsundelete /dev/nvme1n1p2 -s -m 'save*.rar'`, and it showed that the files are 100% available. However, when I attempt to recover:
```
$ hexdump savedgames-2025-07-010.rar
0000000 0000 0000 0000 0000 0000 0000 0000 0000
*
1e2e000
```
Thus, the contents are just zeros. Additionally, trying to test the RAR files returns an error indicating they are not valid archives.
Can anyone shed some light on what might be happening? Thanks in advance!
3 Answers
Are you sure the `%age` column actually indicates file availability? Just looking at the name, it seems it might not mean what you think. Also, is your filesystem encrypted in any way?
I did some experiments too, and it appears that recovering from a TRIM-enabled NVMe drive is pretty much impossible. It works well with regular drives, though! Just keep in mind that recovered files might not behave like the originals. For example, a file I deleted from a rotating drive was recovered, but it ended up being a different size than expected!
It sounds like your volume might have been trimmed, which could mean the original data is gone for good. Unfortunately, if it's been trimmed, there's not much you can do to recover those files. Better luck next time!
I found a similar thread that confirmed trimming likely discarded the contents. I'll be trying `ntfsundelete` on a regular HDD to see if I get better results. Thanks for the heads up!
I double-checked, and according to the `man` page, that column does refer to how much of the file can potentially be recovered. Thankfully, my filesystem isn't encrypted.