path: root/ntfsprogs/ntfsundelete.8 (plain)
blob: 18de27f40d652eb7ce28ce447ec9f150c571f882

1	.\" Copyright (c) 2002\-2005 Richard Russon.
2	.\" This file may be copied under the terms of the GNU Public License.
3	.\"
4	.TH NTFSUNDELETE 8 "November 2005" "ntfs-3g 2014.2.15"
5	.SH NAME
6	ntfsundelete \- recover a deleted file from an NTFS volume.
7	.SH SYNOPSIS
8	.B ntfsundelete
9	[\fIoptions\fR] \fIdevice\fR
10	.SH DESCRIPTION
11	.B ntfsundelete
12	has three modes of operation:
13	.IR scan ,
14	.I undelete
15	and
16	.IR copy .
17	.SS Scan
18	.PP
19	The default mode,
20	.I scan
21	simply reads an NTFS Volume and looks for files that have been deleted. Then it
22	will print a list giving the inode number, name and size.
23	.SS Undelete
24	.PP
25	The
26	.I undelete
27	mode takes the files either matching the regular expression (option \-m)
28	or specified by the inode\-expressions and recovers as much of the data
29	as possible. It saves the result to another location. Partly for
30	safety, but mostly because NTFS write support isn't finished.
31	.SS Copy
32	.PP
33	This is a wizard's option. It will save a portion of the MFT to a file. This
34	probably only be useful when debugging
35	.I ntfsundelete
36	.SS Notes
37	.B ntfsundelete
38	only ever
39	.B reads
40	from the NTFS Volume.
41	.B ntfsundelete
42	will never change the volume.
43	.SH CAVEATS
44	.SS Miracles
45	.B ntfsundelete
46	cannot perform the impossible.
47	.PP
48	When a file is deleted the MFT Record is marked as not in use and the bitmap
49	representing the disk usage is updated. If the power isn't turned off
50	immediately, the free space, where the file used to live, may become
51	overwritten. Worse, the MFT Record may be reused for another file. If this
52	happens it is impossible to tell where the file was on disk.
53	.PP
54	Even if all the clusters of a file are not in use, there is no guarantee that
55	they haven't been overwritten by some short\-lived file.
56	.SS Locale
57	In NTFS all the filenames are stored as Unicode. They will be converted into
58	the current locale for display by
59	.BR ntfsundelete .
60	The utility has successfully displayed some Chinese pictogram filenames and then
61	correctly recovered them.
62	.SS Extended MFT Records
63	In rare circumstances, a single MFT Record will not be large enough to hold the
64	metadata describing a file (a file would have to be in hundreds of fragments
65	for this to happen). In these cases one MFT record may hold the filename, but
66	another will hold the information about the data.
67	.B ntfsundelete
68	will not try and piece together such records. It will simply show unnamed files
69	with data.
70	.SS Compressed and Encrypted Files
71	.B ntfsundelete
72	cannot recover compressed or encrypted files. When scanning for them, it will
73	display as being 0% recoverable.
74	.SS The Recovered File's Size and Date
75	To recover a file
76	.B ntfsundelete
77	has to read the file's metadata. Unfortunately, this isn't always intact.
78	When a file is deleted, the metadata can be left in an inconsistent state. e.g.
79	the file size may be zero; the dates of the file may be set to the time it was
80	deleted, or random.
81	.br
82	To be safe
83	.B ntfsundelete
84	will pick the largest file size it finds and write that to disk. It will also
85	try and set the file's date to the last modified date. This date may be the
86	correct last modified date, or something unexpected.
87	.SH OPTIONS
88	Below is a summary of all the options that
89	.B ntfsundelete
90	accepts. Nearly all options have two equivalent names. The short name is
91	preceded by
92	.B \-
93	and the long name is preceded by
94	.BR \-\- .
95	Any single letter options, that don't take an argument, can be combined into a
96	single command, e.g.
97	.B \-fv
98	is equivalent to
99	.BR "\-f \-v" .
100	Long named options can be abbreviated to any unique prefix of their name.
101	.TP
102	\fB\-b\fR, \fB\-\-byte\fR NUM
103	If any clusters of the file cannot be recovered, the missing parts will be
104	filled with this byte. The default is zeros.
105	.TP
106	\fB\-C\fR, \fB\-\-case\fR
107	When scanning an NTFS volume, any filename matching (using the
108	.B \-\-match
109	option) is case\-insensitive. This option makes the matching case\-sensitive.
110	.TP
111	\fB\-c\fR, \fB\-\-copy\fR RANGE
112	This wizard's option will write a block of MFT FILE records to a file. The
113	default file is
114	.I mft
115	which will be created in the current directory. This option can be combined
116	with the
117	.B \-\-output
118	and
119	.B \-\-destination
120	options.
121	.TP
122	\fB\-d\fR, \fB\-\-destination\fR DIR
123	This option controls where to put the output file of the
124	.B \-\-undelete
125	and
126	.B \-\-copy
127	options.
128	.TP
129	\fB\-f\fR, \fB\-\-force\fR
130	This will override some sensible defaults, such as not overwriting an existing
131	file. Use this option with caution.
132	.TP
133	\fB\-h\fR, \fB\-\-help\fR
134	Show a list of options with a brief description of each one.
135	.TP
136	\fB\-i\fR, \fB\-\-inodes\fR RANGE
137	Recover the files with these inode numbers.
138	.I RANGE
139	can be a single inode number, several numbers separated by commas "," or a
140	range separated by a dash "\-".
141	.TP
142	\fB\-m\fR, \fB\-\-match\fR PATTERN
143	Filter the output by only looking for matching filenames. The pattern can
144	include the wildcards '?', match exactly one character or '*', match zero or
145	more characters. By default the matching is case\-insensitive. To make the
146	search case sensitive, use the
147	.B \-\-case
148	option.
149	.TP
150	\fB\-O\fR, \fB\-\-optimistic\fR
151	Recover parts of the file even if they are currently marked as in use.
152	.TP
153	\fB\-o\fR, \fB\-\-output\fR FILE
154	Use this option to set name of output file that
155	.B \-\-undelete
156	or
157	.B \-\-copy
158	will create.
159	.TP
160	\fB\-P\fR, \fB\-\-parent\fR
161	Display the parent directory of a deleted file.
162	.TP
163	\fB\-p\fR, \fB\-\-percentage\fR NUM
164	Filter the output of the
165	.B \-\-scan
166	option, by only matching files with a certain amount of recoverable content.
167	.B Please read the caveats section for more details.
168	.TP
169	\fB\-q\fR, \fB\-\-quiet\fR
170	Reduce the amount of output to a minimum. Naturally, it doesn't make sense to
171	combine this option with
172	.BR \-\-scan .
173	.TP
174	\fB\-s\fR, \fB\-\-scan\fR
175	Search through an NTFS volume and print a list of files that could be recovered.
176	This is the default action of
177	.BR ntfsundelete .
178	This list can be filtered by filename, size, percentage recoverable or last
179	modification time, using the
180	.BR \-\-match ,
181	.BR \-\-size ,
182	.B \-\-percent
183	and
184	.B \-\-time
185	options, respectively.
186	.sp
187	The output of scan will be:
188	.sp
189	.nf
190	Inode Flags %age Date Time Size Filename
191	6038 FN.. 93% 2002\-07\-17 13:42 26629 thesis.doc
192	.fi
193	.TS
194	box;
195	lB lB
196	l l.
197	Flag Description
198	F/D File/Directory
199	N/R (Non\-)Resident data stream
200	C/E Compressed/Encrypted data stream
201	! Missing attributes
202	.TE
203	.sp
204	.sp
205	The percentage field shows how much of the file can potentially be recovered.
206	.TP
207	\fB\-S\fR, \fB\-\-size\fR RANGE
208	Filter the output of the
209	.B \-\-scan
210	option, by looking for a particular range of file sizes. The range may be
211	specified as two numbers separated by a '\-'. The sizes may be abbreviated
212	using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes
213	respectively.
214	.TP
215	\fB\-t\fR, \fB\-\-time\fR SINCE
216	Filter the output of the
217	.B \-\-scan
218	option. Only match files that have been altered since this time. The time must
219	be given as number using a suffix of d, w, m, y for days, weeks, months or years
220	ago.
221	.TP
222	\fB\-T\fR, \fB\-\-truncate\fR
223	If
224	.B ntfsundelete
225	is confident about the size of a deleted file, then it will restore the file to
226	exactly that size. The default behaviour is to round up the size to the nearest
227	cluster (which will be a multiple of 512 bytes).
228	.TP
229	\fB\-u\fR, \fB\-\-undelete\fR
230	Select
231	.B undelete
232	mode. You can specify the files to be recovered using by using
233	.B \-\-match
234	or
235	.B \-\-inodes
236	options. This option can be combined with
237	.BR \-\-output ,
238	.BR \-\-destination ,
239	and
240	.BR \-\-byte .
241	.sp
242	When the file is recovered it will be given its original name, unless the
243	.B \-\-output
244	option is used.
245	.TP
246	\fB\-v\fR, \fB\-\-verbose\fR
247	Increase the amount of output that
248	.B ntfsundelete
249	prints.
250	.TP
251	\fB\-V\fR, \fB\-\-version\fR
252	Show the version number, copyright and license for
253	.BR ntfsundelete .
254	.SH EXAMPLES
255	Look for deleted files on /dev/hda1.
256	.RS
257	.sp
258	.B ntfsundelete /dev/hda1
259	.sp
260	.RE
261	Look for deleted documents on /dev/hda1.
262	.RS
263	.sp
264	.B ntfsundelete /dev/hda1 \-s \-m '*.doc'
265	.sp
266	.RE
267	Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the
268	data recoverable, on /dev/hda1.
269	.RS
270	.sp
271	.B ntfsundelete /dev/hda1 \-S 5k\-6m \-p 90
272	.sp
273	.RE
274	Look for deleted files altered in the last two days
275	.RS
276	.sp
277	.B ntfsundelete /dev/hda1 \-t 2d
278	.sp
279	.RE
280	Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1
281	.RS
282	.sp
283	.B ntfsundelete /dev/sda1 \-u \-i 2,5,100\-131
284	.sp
285	.RE
286	Undelete inode number 3689, call the file 'work.doc', set it to recovered
287	size and put it in the user's home directory.
288	.RS
289	.sp
290	.B ntfsundelete /dev/hda1 \-u \-T \-i 3689 \-o work.doc \-d ~
291	.sp
292	.RE
293	Save MFT Records 3689 to 3690 to a file 'debug'
294	.RS
295	.sp
296	.B ntfsundelete /dev/hda1 \-c 3689\-3690 \-o debug
297	.sp
298	.RE
299	.SH BUGS
300	There are some small limitations to
301	.BR ntfsundelete ,
302	but currently no known bugs. If you find a bug please send an email describing
303	the problem to the development team:
304	.br
305	.nh
306	ntfs\-3g\-devel@lists.sf.net
307	.hy
308	.SH AUTHORS
309	.B ntfsundelete
310	was written by Richard Russon and Holger Ohmacht, with contributions from Anton
311	Altaparmakov.
312	It was ported to ntfs-3g by Erik Larsson and Jean-Pierre Andre.
313	.SH AVAILABILITY
314	.B ntfsundelete
315	is part of the
316	.B ntfs-3g
317	package and is available from:
318	.br
319	.nh
320	http://www.tuxera.com/community/
321	.hy
322	.SH SEE ALSO
323	.BR ntfsinfo (8),
324	.BR ntfsprogs (8)
325