ntfsundelete [options] device
ntfsundelete has three modes of operation: scan, undelete and copy.
The default mode, scan simply reads an NTFS Volume and looks for files that have been deleted. Then it will print a list giving the inode number, name and size.
The undelete mode takes the files either matching the regular expression (option -m) or specified by the inode-expressions and recovers as much of the data as possible. It saves the result to another location. Partly for safety, but mostly because NTFS write support isn't finished.
This is a wizard's option. It will save a portion of the MFT to a file. This probably only be useful when debugging ntfsundelete
When a file is deleted the MFT Record is marked as not in use and the bitmap representing the disk usage is updated. If the power isn't turned off immediately, the free space, where the file used to live, may become overwritten. Worse, the MFT Record may be reused for another file. If this happens it is impossible to tell where the file was on disk.
Even if all the clusters of a file are not in use, there is no guarantee that they haven't been overwritten by some short-lived file.
Below is a summary of all the options that ntfsundelete accepts. Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -fv is equivalent to -f -v. Long named options can be abbreviated to any unique prefix of their name.
The output of scan will be:
Inode Flags %age Date Time Size Filename 6038 FN.. 93% 2002-07-17 13:42 26629 thesis.doc
The percentage field shows how much of the file can potentially be recovered.
When the file is recovered it will be given its original name, unless the --output option is used.
Look for deleted files on /dev/hda1.
ntfsundelete /dev/hda1 -s -m '*.doc'
ntfsundelete /dev/hda1 -S 5k-6m -p 90
ntfsundelete /dev/hda1 -t 2d
ntfsundelete /dev/sda1 -u -i 2,5,100-131
ntfsundelete /dev/hda1 -u -T -i 3689 -o work.doc -d ~
ntfsundelete /dev/hda1 -c 3689-3690 -o debug
There are some small limitations to ntfsundelete, but currently no known bugs. If you find a bug please send an email describing the problem to the development team: firstname.lastname@example.org
ntfsundelete was written by Richard Russon and Holger Ohmacht, with contributions from Anton Altaparmakov. It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.
ntfsundelete is part of the ntfs-3g package and is available from: http://www.tuxera.com/community/