Man page 8 : ntfsundelete

ntfsundelete - recover a deleted file from an NTFS volume.

ntfsundelete [options] device

ntfsundelete has three modes of operation: scan , undeleteand copy .

3.1. Scan ▲

3.2. Undelete ▲

3.3. Copy ▲

3.4. Notes ▲

4.1. Miracles ▲

4.2. Locale ▲

4.3. Extended MFT Records ▲

4.4. Compressed and Encrypted Files ▲

4.5. The Recovered File's Size and Date ▲

Below is a summary of all the options that

ntfsundelete accepts. Nearly all options have two equivalent names. The short name is preceded by

- and the long name is preceded by

R -- . Any single letter options, that don't take an argument, can be combined into a single command, e.g.

-fv is equivalent to

R Long named options can be abbreviated to any unique prefix of their name.

• -b, --byte NUM
      If any clusters of the file cannot be recovered, the missing parts will be filled with this byte. The default is zeros.
• -C, --case
      When scanning an NTFS volume, any filename matching (using the

--match option) is case-insensitive. This option makes the matching case-sensitive.

• -c, --copy RANGE
      This wizard's option will write a block of MFT FILE records to a file. The default file is mftwhich will be created in the current directory. This option can be combined with the

--output and

--destination options.

• -d, --destination DIR
      This option controls where to put the output file of the

--undelete and

--copy options.

• -f, --force
      This will override some sensible defaults, such as not overwriting an existing file. Use this option with caution.
• -h, --help
      Show a list of options with a brief description of each one.
• -i, --inodes RANGE
      Recover the files with these inode numbers. RANGEcan be a single inode number, several numbers separated by commas "," or a range separated by a dash "-".
• -m, --match PATTERN
      Filter the output by only looking for matching filenames. The pattern can include the wildcards '?', match exactly one character or '*', match zero or more characters. By default the matching is case-insensitive. To make the search case sensitive, use the

--case option.

• -O, --optimistic
      Recover parts of the file even if they are currently marked as in use.
• -o, --output FILE
      Use this option to set name of output file that

--undelete or

--copy will create.

• -P, --parent
      Display the parent directory of a deleted file.
• -p, --percentage NUM
      Filter the output of the

--scan option, by only matching files with a certain amount of recoverable content.

Please read the caveats section for more details.

• -q, --quiet
      Reduce the amount of output to a minimum. Naturally, it doesn't make sense to combine this option with

R --scan .

• -s, --scan
      Search through an NTFS volume and print a list of files that could be recovered. This is the default action of

R ntfsundelete . This list can be filtered by filename, size, percentage recoverable or last modification time, using the

R --match ,

R --size ,

--percent and

--time options, respectively.

The output of scan will be:

Inode  Flags  %age     Date      Size  Filename
 6038  FN..    93%  2002-07-17  26629  thesis.doc

The percentage field shows how much of the file can potentially be recovered.

• -S, --size RANGE
      Filter the output of the

--scan option, by looking for a particular range of file sizes. The range may be specified as two numbers separated by a '-'. The sizes may be abbreviated using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes respectively.

• -t, --time SINCE
      Filter the output of the

--scan option. Only match files that have been altered since this time. The time must be given as number using a suffix of d, w, m, y for days, weeks, months or years ago.

• -T, --truncate
      If

ntfsundelete is confident about the size of a deleted file, then it will restore the file to exactly that size. The default behaviour is to round up the size to the nearest cluster (which will be a multiple of 512 bytes).

• -u, --undelete
      Select

undelete mode. You can specify the files to be recovered using by using

--match or

--inodes options. This option can be combined with

R --output ,

R --destination , and

R --byte .

When the file is recovered it will be given its original name, unless the

--output option is used.

• -v, --verbose
      Increase the amount of output that

ntfsundelete prints.

• -V, --version
      Show the version number, copyright and license for

R ntfsundelete .

Look for deleted files on /dev/hda1.

ntfsundelete /dev/hda1

Look for deleted documents on /dev/hda1.

ntfsundelete /dev/hda1 -s -m '*.doc'

Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the data recoverable, on /dev/hda1.

ntfsundelete /dev/hda1 -S 5k-6m -p 90

Look for deleted files altered in the last two days

ntfsundelete /dev/hda1 -t 2d

Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1

ntfsundelete /dev/sda1 -u -i 2,5,100-131

Undelete inode number 3689, call the file 'work.doc' and put it in the user's home directory.

ntfsundelete /dev/hda1 -u -i 3689 -o work.doc -d ~

Save MFT Records 3689 to 3690 to a file 'debug'

ntfsundelete /dev/hda1 -c 3689-3690 -o debug

There are some small limitations to

R ntfsundelete , but currently no known bugs. If you find a bug please send an email describing the problem to the development team:

ntfsundelete was written by Richard Russon and Holger Ohmacht, with contributions from Anton Altaparmakov.

ntfsundelete is part of the

ntfsprogs package and is available from:
http://www.linux-ntfs.org/content/view/19/37

The manual pages are available online at:
http://man.linux-ntfs.org/

R ntfsinfo (8),

R ntfsprogs (8)