1 .\" Copyright (c) 2002 Richard Russon. All Rights Reserved.
2 .\" This file may be copied under the terms of the GNU Public License.
4 .TH NTFSUNDELETE 8 "June 2002" "Linux\-NTFS version @VERSION@"
6 ntfsundelete \- recover a deleted file from an NTFS volume.
15 has three modes of operation:
24 simply reads an NTFS Volume and looks for files that have been deleted. Then it
25 will print a list giving the inode number, name and size.
30 mode takes the inode and recovers as much of the data as possible. It saves the
31 result to another location. Partly for safety, but mostly because NTFS write
32 support isn't finished.
35 This is a wizard's option. It will save a portion of the MFT to a file. This
36 probably only be useful when debugging
44 will never change the volume.
48 cannot perform the impossible.
50 When a file is deleted the MFT Record is marked as not in use and the bitmap
51 representing the disk usage is updated. If the power isn't turned off
52 immediately, the free space, where the file used to live, may become
53 overwritten. Worse, the MFT Record may be reused for another file. If this
54 happens it is impossible to tell where the file was on disk.
56 Even if all the clusters of a file are not in use, there is no guarantee that
57 they haven't been overwritten by some short\-lived file.
59 In NTFS all the filenames are stored as Unicode. They will be converted into
60 the current locale for display by
62 The utility has successfully displayed some Chinese pictogram filenames and then
63 correctly recovered them.
64 .SS Extended MFT Records
65 In rare circumstances, a single MFT Record will not be large enough to hold the
66 metadata describing a file (a file would have to be in hundreds of fragments
67 for this to happen). In these cases one MFT record may hold the filename, but
68 another will hold the information about the data.
70 will not try and piece together such records. It will simply show unnamed files
72 .SS Compressed and Encrypted Files
74 cannot recover compressed or encrypted files. When scanning for them, it will
75 display as being 0% recoverable.
76 .SS The Recovered File's Size and Date
79 has to read the file's metadata. Unfortunately, this isn't always intact.
80 When a file is deleted, the metadata can be left in an inconsistant state. e.g.
81 the file size may be zero; the dates of the file may be set to the time it was
86 will pick the largest file size it finds and write that to disk. It will also
87 try and set the file's date to the last modified date. This date may be the
88 correct last modified date, or something unexpected.
90 Below is a summary of all the options that
92 accepts. All options have two equivalent names. The short name is preceded by
94 and the long name is preceded by
96 Any single letter options, that don't take an argument, can be combined into a
101 Long named options can be abbreviated to any unique prefix of their name.
108 If any clusters of the file cannot be recovered, the missing parts will be
109 filled with this byte. The default is zeros.
116 When scanning an NTFS volume, any filename matching (using the
118 option) is case\-insensitive. This option makes the maching case\-sensitive.
124 .BI "\-\-copy " range
125 This wizard's option will write a block of MFT FILE records to a file. The
128 which will be created in the current directory. This option can be combined
139 .BI "\-\-destination " dir
140 This option controls where to put the output file of the
151 This will override some sensible defaults, such as not overwriting an existing
152 file. Use this option with caution.
159 Show a list of options with a brief description of each one.
165 .BI "\-\-match " pattern
166 Filter the output of the
168 option, by only looking for matching filenames. The pattern can include the
169 wildcards '?', match exactly one character or '*', match zero or more
170 characters. By default the matching is case\-insensitive. To make the search
171 case sensitive, use the
179 .BI "\-\-output " file
180 Use this option to set name of output file that
190 .BI "\-\-percentage " num
191 Filter the output of the
193 option, by only matching files with a certain amount of recoverable content.
194 .B Please read the caveats section for more details.
201 Reduce the amount of output to a minimum. Naturally, it doesn't make sense to
202 combine this option with
210 Search through an NTFS volume and print a list of files that could be recovered.
211 This is the default action of
213 This list can be filtered by filename, size, percentage recoverable or last
214 modification time, using the
220 options, respectively.
222 The output of scan will be:
225 Inode Flags %age Date Size Filename
226 6038 FN.. 93% 2002-07-17 26629 thesis.doc
233 N/R (Non-)Resident data stream
234 C/E Compressed/Encrypted data stream
240 The percentage field shows how much of the file can potentially be recovered.
248 .BI "\-\-size " range
249 Filter the output of the
251 option, by looking for a particular range of file sizes. The range may be
252 specified as two numbers separated by a '\-'. The sizes may be abbreviated
253 using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes
260 .BI "\-\-time " since
261 Filter the output of the
263 option. Only match files that have been altered since this time. The time must
264 be given as number using a suffix of d, w, m, y for days, weeks, months or years
271 .BI "\-\-undelete " num
272 Recover the file with this inode number. This option can be combined with
274 .BR \-\-destination ,
278 When the file is recovered it will be given its original name, unless the
287 Increase the amount of output that
296 Show the version number, copyright and license
299 Look for deleted files on /dev/hda1.
302 .B ntfsundelete /dev/hda1
305 Look for deleted documents on /dev/hda1.
308 .B ntfsundelete /dev/hda1 -s \-m '*.doc'
311 Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the
312 data recoverable, on /dev/hda1.
315 .B ntfsundelete /dev/hda1 \-S 5k\-6m \-p 90
318 Look for deleted files altered in the last two days
321 .B ntfsundelete /dev/hda1 \-t 2d
324 Undelete inode number 3689, call the file 'work.doc' and put it in the user's
328 .B ntfsundelete /dev/hda1 \-u 3689 \-o work.doc \-d ~
331 Save MFT Records 3689 to 3690 to a file 'debug'
334 .B ntfsundelete /dev/hda1 \-c 3689\-3690 \-o debug
337 There are some small limitations to this program, but currently no known bugs.
338 If you find one, please send an email to
340 <linux-ntfs-dev@lists.sf.net>
344 was written by Richard Russon (FlatCap) <ntfs@flatcap.org>
346 If you find this tool useful, make FlatCap happy and send him an email.
349 is part of the linux\-ntfs package and is available from
352 http://linux\-ntfs.sourceforge.net/downloads.html