|
From: Richard R. <fl...@us...> - 2002-07-15 22:45:49
|
Changes by: flatcap Update of /cvsroot/linux-ntfs/linux-ntfs/ntfstools In directory usw-pr-cvs1:/tmp/cvs-serv8832 Modified Files: ntfsundelete.8.in Log Message: enough! Index: ntfsundelete.8.in =================================================================== RCS file: /cvsroot/linux-ntfs/linux-ntfs/ntfstools/ntfsundelete.8.in,v retrieving revision 1.3 retrieving revision 1.4 diff -U2 -r1.3 -r1.4 --- ntfsundelete.8.in 15 Jul 2002 16:30:41 -0000 1.3 +++ ntfsundelete.8.in 15 Jul 2002 22:45:45 -0000 1.4 @@ -14,21 +14,27 @@ .B ntfsundelete has three modes of operation: -.I scan, +.IR scan , .I undelete and -.I copy. - - - - -In the simplest case, -.B ntfsundelete -scans an NTFS volume for files that have been deleted and prints -a list of them. +.IR copy . +.SS Scan +.PP +The default mode, +.I scan +simply reads an NTFS Volume and looks for files that have been deleted. Then it +will print a list giving the inode number, name and size. +.SS Undelete .PP - - +The +.I undelete +mode takes the inode and recovers as much of the data as possible. It save the +result to another location. Partly for safety, but mostly because NTFS write +support isn't finished. +.SS Copy .PP -.B Note: +This is a wizard's option. It will save a portion of the MFT to a file. This +probably only be useful when debugging +.I ntfsundelete +.SS Notes .B ntfsundelete only ever @@ -37,20 +43,44 @@ .B ntfsundelete will never change the volume. - +.SH CAVEATS +.SS Miracles +.B ntfsundelete +cannot perform the impossible. +.PP +When a file is deleted the MFT Record is marked as not in use and the bitmap +representing the disk usage is updated. If the power isn't turned off +immediately, the free space, where the file used to live, may become +overwritten. Worse, the MFT Record may be reused for another file. If this +happens it is impossible to tell where the file was on disk. +.PP +Even if all the clusters of a file are not in use, there is no guarantee that +they haven't been overwritten by some short\-lived file. +.SS Locale +In NTFS all the filenames are stored as Unicode. They will be converted into +the current locale for display by +.B ntfsundelete. +The utility has successfully displayed some Chinese pictogram filenames and then +correctly recovered them. +.SS Extended MFT Records +In rare circumstances, a single MFT Record will not be large enough to hold the +metadata describing a file (a file would have to be in hundreds of fragments +for this to happen). In these cases one MFT record may hold the filename, but +another will hold the information about the data. +.B ntfsundelete +will not try and piece together such records. It will simply show unnamed files +with data. .SH OPTIONS Below is a summary of all the options that .B ntfsundelete -accepts. All options have two equivalent names. The short name -is preceded by +accepts. All options have two equivalent names. The short name is preceded by .BR \- and the long name is preceded by .BR \-\- . -Any single letter options, that don't take an argument, can be -combined into a single command, e.g. +Any single letter options, that don't take an argument, can be combined into a +single command, e.g. .BR \-fv is equivalent to .BR "\-f \-v". -Long named options can be abbreviated to any unique prefix of -their name. +Long named options can be abbreviated to any unique prefix of their name. .TP .BI "\-b " num @@ -59,6 +89,6 @@ .TP .BI "\-\-byte " num -If any clusters of the file cannot be recovered, the missing -parts will be filled with this byte. The default is zeros. +If any clusters of the file cannot be recovered, the missing parts will be +filled with this byte. The default is zeros. .TP .B \-C @@ -67,21 +97,18 @@ .TP .B \-\-case -When -.I scanning -an NTFS volume, any filename matching (using the -.I \-\-match -option) is case\-insensitive. This option makes the maching -case\-sensitive. +When scanning an NTFS volume, any filename matching (using the +.B \-\-match +option) is case\-insensitive. This option makes the maching case\-sensitive. .TP -.BI "\-\-copy " range +.BI "\-c " range .br .ns .TP -.BI "\-c " range -This wizard's option will write a block of MFT FILE records to -a file. The default file is +.BI "\-\-copy " range +This wizard's option will write a block of MFT FILE records to a file. The +default file is .I mft -which will be created in the current directory. This option can -be combined with the +which will be created in the current directory. This option can be combined +with the .B \-\-output and @@ -218,20 +245,47 @@ .B ntfsundelete. .SH EXAMPLES -.SH CAVEATS -.SS Miracles -.SS Extended MFT Records -.B ntfsundelete -cannot perform miracles. -Even if a file is entirely within unused portions of the disk, it does not -guarantee that the file hasn't been partially overwritten. -read only -locale -extended mft records != file framentation -if you find this tool useful -potential, no guarantee +.TP +Look for deleted files on /dev/hda1. +.RS 4 +.TP +.B ntfsundelete /dev/hda1 +.RE +.TP +Look for deleted documents on /dev/hda1. +.RS 4 +.TP +.B ntfsundelete /dev/hda1 -s \-m '*.doc' +.RE +.TP +Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the data recoverable, on /dev/hda1. +.RS 4 +.TP +.B ntfsundelete /dev/hda1 \-S 5k\-6m \-p 90 +.RE +.TP +Look for deleted files altered in the last two days +.RS 4 +.TP +.B ntfsundelete /dev/hda1 \-t 2d +.RE +.TP +Undelete inode number 3689, call the file 'work.doc' and put it in the user's home directory. +.RS 4 +.TP +.B ntfsundelete /dev/hda1 \-u 3689 \-o work.doc \-d ~ +.RE +.TP +Save MFT Records 3689 to 3690 to a file 'debug' +.RS 4 +.TP +.B ntfsundelete /dev/hda1 \-c 3689\-3690 \-o debug .SH BUGS +There are some small limitations to this program, but currently no known bugs. +If you find one, please email the author and let him know. .SH AUTHOR .B ntfsundelete was written by Richard Russon (FlatCap) <nt...@fl...> +.br +If you find this tool useful, please send him an email :\-) .SH AVAILABILITY .B ntfsundelete |
