1NTFSRECOVER(8) System Manager's Manual NTFSRECOVER(8)
2
6 ntfsrecover - Recover updates committed by Windows on an NTFS volume
7
9 ntfsrecover [options] device
10
12 ntfsrecover applies to the metadata the updates which were requested on
13 Windows but could not be completed because they were interrupted by
14 some event such as a power failure, a hardware crash, a software crash
15 or the device being unplugged. Doing so, the file system is restored
16 to a consistent state, however updates to user data may still be lost.
17 Updating the file system generally requires updating several records
19 which should all be made for the file system to be kept consistent. For
20 instance, creating a new file requires reserving an inode number (set a
21 bit in a bit map), creating a file record (store the file name and file
22 attributes), and registering the file in a directory (locate the file
23 from some path). When an unfortunate event occurs, and one of these up‐
24 dates could be done but not all of them, the file system is left incon‐
25 sistent.
26 A group of updates which have all to be done to preserve consistency is
28 called a transaction, and the end of updates within a transaction is
29 called the commitment of the transaction.
30 To protect from unfortunate events, Windows first logs in a special
32 file all the metadata update requests without applying any, until the
33 commitment is known. If the event occurs before the commitment, no up‐
34 date has been made and the file system is consistent. If the event oc‐
35 curs after the update, the log file can be analyzed later and the
36 transactions which were committed can be executed again, thus restoring
37 the integrity of the file system.
38 ntfsrecover similarly examines the log file and applies the updates
40 within committed transactions which could not be done by Windows.
41 Currently, ntfs-3g does not log updates, so ntfsrecover cannot be used
43 to restore consistency after an unfortunate event occurred while the
44 file system was updated by Linux.
45
48 Below is a summary of all the options that ntfsrecover accepts. The
49 normal usage is to use no option at all, as most of these options are
50 oriented towards developers needs.
51 Nearly all options have two equivalent names. The short name is pre‐
53 ceded by - and the long name is preceded by --. Any single letter op‐
54 tions, that don't take an argument, can be combined into a single com‐
55 mand, e.g. -bv is equivalent to -b -v. Long named options can be ab‐
56 breviated to any unique prefix of their name.
57 -b, --backward
59 Examine the actions described in the logfile backward from the
60 latest one to the earliest one without applying any update. This
61 may encompass records generated during several sessions, and
62 when Windows is restarted, it often does not restart writing
63 where it ended the previous session, so this leads to errors and
64 bad sequencing when examining the full log file.
65 -c, --clusters CLUSTER-RANGE
67 Restrict the output generated when using options -b -f -u -p to
68 the actions operating on a cluster within the given cluster
69 range. CLUSTER-RANGE is defined by the first and last cluster
70 numbers separated by a hyphen, for instance 100-109 or
71 0x3e8-0x3ff. A single number means restricting to a single clus‐
72 ter. The first four log blocks have a special role and they are
73 always shown.
74 -f, --forward NUM
76 Examine the actions described in the logfile forward from the
77 first one to the last one without applying any update. As the
78 log file is reused circularly, the first one is generally not
79 the earliest. Moreover when Windows is restarted, it often does
80 not restart writing where it ended the previous sessions, and
81 this leads to errors when examining a log file generated during
82 several sessions.
83 -h, --help
85 Show some help information.
86 -k, --kill-fast-restart
88 When Windows has been interrupted with fast restart mode acti‐
89 vated, part of pending changes are kept in the Windows cache and
90 only the same Windows version can recover them. This option can
91 be used to apply the changes recorded in the log file and drop
92 the ones in the Windows cache. This is dangerous and may cause
93 loss of data.
94 -n, --no-action
96 Do not apply any modification, useful when using the options -p,
97 -s or -u.
98 -p, --play COUNT
100 Undo COUNT transaction sets and redo a single one, a transaction
101 set being all transactions between two consecutive checkpoints.
102 This is useful for replaying some transaction in the past. As a
103 few actions are not undoable, this is not always possible.
104 -r, --range BLOCK-RANGE
106 Examine the actions described in the logfile forward restricted
107 to the requested log file block range without applying any up‐
108 date. The first four log blocks have a special role and they are
109 always examined.
110 -s, --sync
112 Sync the file system by applying the committed actions which
113 have not been synced previously. This is the default option,
114 used when none of the options -n, -f, -r, -p and -u are present.
115 The option -s can be repeated to request applying the committed
117 actions mentioned in the obsolete restart page. This is useful
118 for testing the situations where the latest restart page cannot
119 be read though it can actually be read.
120 -t, --transactions COUNT
122 Display the transaction parameters when examining the log file
123 with one of the options --forward, --backward or --range.
124 -u, --undo COUNT
126 Undo COUNT transaction sets, thus resetting the file system to
127 some checkpoint in the past, a transaction set being all trans‐
128 actions between two consecutive checkpoints. As a few actions
129 are not undoable, this is not always possible.
130 -v, --verbose
132 Display more debug/warning/error messages. This option may be
133 used twice to display even more information.
134 -V, --version
136 Show the version number, copyright and license of ntfsrecover.
137
139 Sync an NTFS volume on /dev/sda1.
140 ntfsrecover -s /dev/sda1
142 Display all actions which updated a cluster in range 100 to 119 :
144 ntfsrecover --verbose --backward --clusters=100-119 /dev/sda1
146
149 If you find a bug please send an email describing the problem to the
150 development team:
151 ntfs-3g-devel@lists.sf.net
152
154 ntfsrecover was written by Jean-Pierre Andre
155
157 ntfsrecover is part of the ntfs-3g package and is available from:
158 https://github.com/tuxera/ntfs-3g/wiki/
159
161 ntfs-3g(8), ntfsfix(8), ntfsprogs(8)
162ntfs-3g 2022.5.17 September 2015 NTFSRECOVER(8)