|-b, --byte NUM|
|If any clusters of the file cannot be recovered, the missing parts will be filled with this byte. The default is zeros.|
|-C, --case||When scanning an NTFS volume, any filename matching (using the --match option) is case-insensitive. This option makes the matching case-sensitive.|
|-c, --copy RANGE|
|This wizards option will write a block of MFT FILE records to a file. The default file is mft which will be created in the current directory. This option can be combined with the --output and --destination options.|
|-d, --destination DIR|
|This option controls where to put the output file of the --undelete and --copy options.|
|This will override some sensible defaults, such as not overwriting an existing file. Use this option with caution.|
|-h, --help||Show a list of options with a brief description of each one.|
|-i, --inodes RANGE|
|Recover the files with these inode numbers. RANGE can be a single inode number, several numbers separated by commas "," or a range separated by a dash "-".|
|-m, --match PATTERN|
|Filter the output by only looking for matching filenames. The pattern can include the wildcards ?, match exactly one character or *, match zero or more characters. By default the matching is case-insensitive. To make the search case sensitive, use the --case option.|
|Recover parts of the file even if they are currently marked as in use.|
|-o, --output FILE|
|Use this option to set name of output file that --undelete or --copy will create.|
|Display the parent directory of a deleted file.|
|-p, --percentage NUM|
|Filter the output of the --scan option, by only matching files with a certain amount of recoverable content. Please read the caveats section for more details.|
|Reduce the amount of output to a minimum. Naturally, it doesnt make sense to combine this option with --scan.|
Search through an NTFS volume and print a list of files that could be recovered.
This is the default action of
ntfsundelete. This list can be filtered by filename, size, percentage recoverable or last
modification time, using the
--time options, respectively.
The output of scan will be:
Inode Flags %age Date Size Filename 6038 FN.. 93% 2002-07-17 26629 thesis.doc
The percentage field shows how much of the file can potentially be recovered.
|-S, --size RANGE|
|Filter the output of the --scan option, by looking for a particular range of file sizes. The range may be specified as two numbers separated by a -. The sizes may be abbreviated using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes respectively.|
|-t, --time SINCE|
|Filter the output of the --scan option. Only match files that have been altered since this time. The time must be given as number using a suffix of d, w, m, y for days, weeks, months or years ago.|
|If ntfsundelete is confident about the size of a deleted file, then it will restore the file to exactly that size. The default behaviour is to round up the size to the nearest cluster (which will be a multiple of 512 bytes).|
undelete mode. You can specify the files to be recovered using by using
--inodes options. This option can be combined with
When the file is recovered it will be given its original name, unless the --output option is used.
|Increase the amount of output that ntfsundelete prints.|
|Show the version number, copyright and license for ntfsundelete.|
Look for deleted files on /dev/hda1.Look for deleted documents on /dev/hda1.
Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the data recoverable, on /dev/hda1.
ntfsundelete /dev/hda1 -s -m *.doc
Look for deleted files altered in the last two days
ntfsundelete /dev/hda1 -S 5k-6m -p 90
Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1
ntfsundelete /dev/hda1 -t 2d
Undelete inode number 3689, call the file work.doc and put it in the users home directory.
ntfsundelete /dev/sda1 -u -i 2,5,100-131
Save MFT Records 3689 to 3690 to a file debug
ntfsundelete /dev/hda1 -u -i 3689 -o work.doc -d ~
ntfsundelete /dev/hda1 -c 3689-3690 -o debug
There are some small limitations to ntfsundelete, but currently no known bugs. If you find a bug please send an email describing the problem to the development team:
ntfsundelete was written by Richard Russon and Holger Ohmacht, with contributions from Anton Altaparmakov.
ntfsundelete is part of the ntfsprogs package and is available from:
The manual pages are available online at:
|ntfsprogs 2.0.0||NTFSUNDELETE (8)||November 2005|