1NTFSUNDELETE(8)             System Manager's Manual            NTFSUNDELETE(8)
2
3
4

NAME

6       ntfsundelete - recover a deleted file from an NTFS volume.
7

SYNOPSIS

9       ntfsundelete [options] device
10

DESCRIPTION

12       ntfsundelete has three modes of operation: scan, undelete and copy.
13
14   Scan
15       The  default mode, scan simply reads an NTFS Volume and looks for files
16       that have been deleted.  Then it will print a  list  giving  the  inode
17       number, name and size.
18
19   Undelete
20       The  undelete  mode takes the files either matching the regular expres‐
21       sion (option -m) or  specified by the inode-expressions and recovers as
22       much  of  the  data as possible.   It saves the result to another loca‐
23       tion.  Partly for safety, but mostly because NTFS write  support  isn't
24       finished.
25
26   Copy
27       This  is  a  wizard's  option.   It will save a portion of the MFT to a
28       file.  This probably only be useful when debugging ntfsundelete
29
30   Notes
31       ntfsundelete only ever reads from the NTFS Volume.   ntfsundelete  will
32       never change the volume.
33

CAVEATS

35   Miracles
36       ntfsundelete cannot perform the impossible.
37
38       When  a  file is deleted the MFT Record is marked as not in use and the
39       bitmap representing the disk usage is  updated.   If  the  power  isn't
40       turned  off  immediately,  the free space, where the file used to live,
41       may become overwritten.  Worse, the MFT Record may be  reused  for  an‐
42       other  file.   If  this happens it is impossible to tell where the file
43       was on disk.
44
45       Even if all the clusters of a file are not in use, there is no  guaran‐
46       tee that they haven't been overwritten by some short-lived file.
47
48   Locale
49       In  NTFS  all  the  filenames are stored as Unicode.  They will be con‐
50       verted into the current locale for display by ntfsundelete.  The  util‐
51       ity  has  successfully  displayed  some Chinese pictogram filenames and
52       then correctly recovered them.
53
54   Extended MFT Records
55       In rare circumstances, a single MFT Record will not be large enough  to
56       hold  the  metadata  describing a file (a file would have to be in hun‐
57       dreds of fragments for this to happen).  In these cases one MFT  record
58       may  hold the filename, but another will hold the information about the
59       data.  ntfsundelete will not try and piece together such  records.   It
60       will simply show unnamed files with data.
61
62   Compressed and Encrypted Files
63       ntfsundelete  cannot recover compressed or encrypted files.  When scan‐
64       ning for them, it will display as being 0% recoverable.
65
66   The Recovered File's Size and Date
67       To recover a file ntfsundelete has to read the file's metadata.  Unfor‐
68       tunately,  this isn't always intact.  When a file is deleted, the meta‐
69       data can be left in an inconsistent state. e.g.  the file size  may  be
70       zero;  the  dates of the file may be set to the time it was deleted, or
71       random.
72       To be safe ntfsundelete will pick the largest file size  it  finds  and
73       write  that  to  disk.  It will also try and set the file's date to the
74       last modified date.  This date may be the correct last  modified  date,
75       or something unexpected.
76

OPTIONS

78       Below  is  a  summary  of  all  the  options that ntfsundelete accepts.
79       Nearly all options have two equivalent names.  The short name  is  pre‐
80       ceded  by - and the long name is preceded by --.  Any single letter op‐
81       tions, that don't take an argument, can be combined into a single  com‐
82       mand,  e.g.  -fv is equivalent to -f -v.  Long named options can be ab‐
83       breviated to any unique prefix of their name.
84
85       -b, --byte NUM
86              If any clusters of the file cannot  be  recovered,  the  missing
87              parts will be filled with this byte.  The default is zeros.
88
89       -C, --case
90              When  scanning  an NTFS volume, any filename matching (using the
91              --match option) is  case-insensitive.   This  option  makes  the
92              matching case-sensitive.
93
94       -c, --copy RANGE
95              This wizard's option will write a block of MFT FILE records to a
96              file.  The default file is mft which will be created in the cur‐
97              rent  directory.   This option can be combined with the --output
98              and --destination options.
99
100       -d, --destination DIR
101              This option controls where to put the output file of  the  --un‐
102              delete and --copy options.
103
104       -f, --force
105              This will override some sensible defaults, such as not overwrit‐
106              ing an existing file.  Use this option with caution.
107
108       -h, --help
109              Show a list of options with a brief description of each one.
110
111       -i, --inodes RANGE
112              Recover the files with these inode numbers.  RANGE can be a sin‐
113              gle  inode  number, several numbers separated by commas "," or a
114              range separated by a dash "-".
115
116       -m, --match PATTERN
117              Filter the output by only looking for matching  filenames.   The
118              pattern can include the wildcards '?', match exactly one charac‐
119              ter or '*', match zero  or  more  characters.   By  default  the
120              matching  is  case-insensitive.   To make the search case sensi‐
121              tive, use the --case option.
122
123       -O, --optimistic
124              Recover parts of the file even if they are currently  marked  as
125              in use.
126
127       -o, --output FILE
128              Use  this  option  to set name of output file that --undelete or
129              --copy will create.
130
131       -P, --parent
132              Display the parent directory of a deleted file.
133
134       -p, --percentage NUM
135              Filter the output of the --scan option, by only  matching  files
136              with  a  certain amount of recoverable content.  Please read the
137              caveats section for more details.
138
139       -q, --quiet
140              Reduce the amount of output to a minimum.  Naturally, it doesn't
141              make sense to combine this option with --scan.
142
143       -s, --scan
144              Search  through  an  NTFS  volume and print a list of files that
145              could be recovered.  This is the default action of ntfsundelete.
146              This list can be filtered by filename, size, percentage recover‐
147              able or last  modification  time,  using  the  --match,  --size,
148              --percent and --time options, respectively.
149
150              The output of scan will be:
151
152              Inode  Flags  %age     Date    Time    Size  Filename
153               6038  FN..    93%  2002-07-17 13:42  26629  thesis.doc
154
155              ┌────────────────────────────────────────┐
156Flag   Description                      
157              │F/D    File/Directory                   │
158              │N/R    (Non-)Resident data stream       │
159              │C/E    Compressed/Encrypted data stream │
160              │!      Missing attributes               │
161              └────────────────────────────────────────┘
162
163              The  percentage field shows how much of the file can potentially
164              be recovered.
165
166       -S, --size RANGE
167              Filter the output of the --scan option, by looking for a partic‐
168              ular  range  of  file  sizes.  The range may be specified as two
169              numbers separated by a '-'.  The sizes may be abbreviated  using
170              the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and
171              terabytes respectively.
172
173       -t, --time SINCE
174              Filter the output of the --scan option.  Only match  files  that
175              have  been  altered  since this time.  The time must be given as
176              number using a suffix of d, w, m, y for days, weeks,  months  or
177              years ago.
178
179       -T, --truncate
180              If  ntfsundelete  is confident about the size of a deleted file,
181              then it will restore the file to exactly that size.  The default
182              behaviour  is to round up the size to the nearest cluster (which
183              will be a multiple of 512 bytes).
184
185       -u, --undelete
186              Select undelete mode.  You can specify the files to be recovered
187              using  by using --match or --inodes options.  This option can be
188              combined with --output, --destination, and --byte.
189
190              When the file is recovered it will be given its  original  name,
191              unless the --output option is used.
192
193       -v, --verbose
194              Increase the amount of output that ntfsundelete prints.
195
196       -V, --version
197              Show the version number, copyright and license for ntfsundelete.
198

EXAMPLES

200       Look for deleted files on /dev/hda1.
201
202              ntfsundelete /dev/hda1
203
204       Look for deleted documents on /dev/hda1.
205
206              ntfsundelete /dev/hda1 -s -m '*.doc'
207
208       Look  for  deleted  files between 5000 and 6000000 bytes, with at least
209       90% of the data recoverable, on /dev/hda1.
210
211              ntfsundelete /dev/hda1 -S 5k-6m -p 90
212
213       Look for deleted files altered in the last two days
214
215              ntfsundelete /dev/hda1 -t 2d
216
217       Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1
218
219              ntfsundelete /dev/sda1 -u -i 2,5,100-131
220
221       Undelete inode number 3689, call the file 'work.doc', set it to  recov‐
222       ered size and put it in the user's home directory.
223
224              ntfsundelete /dev/hda1 -u -T -i 3689 -o work.doc -d ~
225
226       Save MFT Records 3689 to 3690 to a file 'debug'
227
228              ntfsundelete /dev/hda1 -c 3689-3690 -o debug
229
230

BUGS

232       There  are  some  small  limitations  to ntfsundelete, but currently no
233       known bugs.  If you find a bug please  send  an  email  describing  the
234       problem to the development team:
235       ntfs-3g-devel@lists.sf.net
236

AUTHORS

238       ntfsundelete  was  written  by  Richard Russon and Holger Ohmacht, with
239       contributions from Anton Altaparmakov.  It was  ported  to  ntfs-3g  by
240       Erik Larsson and Jean-Pierre Andre.
241

AVAILABILITY

243       ntfsundelete is part of the ntfs-3g package and is available from:
244       http://www.tuxera.com/community/
245

SEE ALSO

247       ntfsinfo(8), ntfsprogs(8)
248
249
250
251ntfs-3g 2021.8.22                November 2005                 NTFSUNDELETE(8)
Impressum