ntfsundelete

recover a deleted file from an NTFS volume.

   
Usage: ntfsundelete [options] device
    -s, --scan             Scan for files (default)
    -p, --percentage NUM   Minimum percentage recoverable
    -m, --match PATTERN    Only work on files with matching names
    -C, --case             Case sensitive matching
    -S, --size RANGE       Match files of this size
    -t, --time SINCE       Last referenced since this time

    -u, --undelete         Undelete mode
    -i, --inodes RANGE     Recover these inodes
    -o, --output FILE      Save with this filename
    -O, --optimistic       Undelete in-use clusters as well
    -d, --destination DIR  Destination directory
    -b, --byte NUM         Fill missing parts with this byte
    -T, --truncate         Truncate 100% recoverable file to exact size.
    -P, --parent           Show parent directory

    -c, --copy RANGE       Write a range of MFT records to a file

    -f, --force            Use less caution
    -q, --quiet            Less output
    -v, --verbose          More output
    -V, --version          Display version information
    -h, --help             Display this help

Developers' email address: linux-ntfs-dev@lists.sf.net
Linux NTFS homepage: http://www.linux-ntfs.org