Changes by: flatcap
Update of /cvsroot/linux-ntfs/linux-ntfs/ntfstools
In directory usw-pr-cvs1:/tmp/cvs-serv8832
Modified Files:
ntfsundelete.8.in
Log Message:
enough!
Index: ntfsundelete.8.in
===================================================================
RCS file: /cvsroot/linux-ntfs/linux-ntfs/ntfstools/ntfsundelete.8.in,v
retrieving revision 1.3
retrieving revision 1.4
diff -U2 -r1.3 -r1.4
--- ntfsundelete.8.in 15 Jul 2002 16:30:41 -0000 1.3
+++ ntfsundelete.8.in 15 Jul 2002 22:45:45 -0000 1.4
@@ -14,21 +14,27 @@
.B ntfsundelete
has three modes of operation:
-.I scan,
+.IR scan ,
.I undelete
and
-.I copy.
-
-
-
-
-In the simplest case,
-.B ntfsundelete
-scans an NTFS volume for files that have been deleted and prints
-a list of them.
+.IR copy .
+.SS Scan
+.PP
+The default mode,
+.I scan
+simply reads an NTFS Volume and looks for files that have been deleted. Then it
+will print a list giving the inode number, name and size.
+.SS Undelete
.PP
-
-
+The
+.I undelete
+mode takes the inode and recovers as much of the data as possible. It save the
+result to another location. Partly for safety, but mostly because NTFS write
+support isn't finished.
+.SS Copy
.PP
-.B Note:
+This is a wizard's option. It will save a portion of the MFT to a file. This
+probably only be useful when debugging
+.I ntfsundelete
+.SS Notes
.B ntfsundelete
only ever
@@ -37,20 +43,44 @@
.B ntfsundelete
will never change the volume.
-
+.SH CAVEATS
+.SS Miracles
+.B ntfsundelete
+cannot perform the impossible.
+.PP
+When a file is deleted the MFT Record is marked as not in use and the bitmap
+representing the disk usage is updated. If the power isn't turned off
+immediately, the free space, where the file used to live, may become
+overwritten. Worse, the MFT Record may be reused for another file. If this
+happens it is impossible to tell where the file was on disk.
+.PP
+Even if all the clusters of a file are not in use, there is no guarantee that
+they haven't been overwritten by some short\-lived file.
+.SS Locale
+In NTFS all the filenames are stored as Unicode. They will be converted into
+the current locale for display by
+.B ntfsundelete.
+The utility has successfully displayed some Chinese pictogram filenames and then
+correctly recovered them.
+.SS Extended MFT Records
+In rare circumstances, a single MFT Record will not be large enough to hold the
+metadata describing a file (a file would have to be in hundreds of fragments
+for this to happen). In these cases one MFT record may hold the filename, but
+another will hold the information about the data.
+.B ntfsundelete
+will not try and piece together such records. It will simply show unnamed files
+with data.
.SH OPTIONS
Below is a summary of all the options that
.B ntfsundelete
-accepts. All options have two equivalent names. The short name
-is preceded by
+accepts. All options have two equivalent names. The short name is preceded by
.BR \-
and the long name is preceded by
.BR \-\- .
-Any single letter options, that don't take an argument, can be
-combined into a single command, e.g.
+Any single letter options, that don't take an argument, can be combined into a
+single command, e.g.
.BR \-fv
is equivalent to
.BR "\-f \-v".
-Long named options can be abbreviated to any unique prefix of
-their name.
+Long named options can be abbreviated to any unique prefix of their name.
.TP
.BI "\-b " num
@@ -59,6 +89,6 @@
.TP
.BI "\-\-byte " num
-If any clusters of the file cannot be recovered, the missing
-parts will be filled with this byte. The default is zeros.
+If any clusters of the file cannot be recovered, the missing parts will be
+filled with this byte. The default is zeros.
.TP
.B \-C
@@ -67,21 +97,18 @@
.TP
.B \-\-case
-When
-.I scanning
-an NTFS volume, any filename matching (using the
-.I \-\-match
-option) is case\-insensitive. This option makes the maching
-case\-sensitive.
+When scanning an NTFS volume, any filename matching (using the
+.B \-\-match
+option) is case\-insensitive. This option makes the maching case\-sensitive.
.TP
-.BI "\-\-copy " range
+.BI "\-c " range
.br
.ns
.TP
-.BI "\-c " range
-This wizard's option will write a block of MFT FILE records to
-a file. The default file is
+.BI "\-\-copy " range
+This wizard's option will write a block of MFT FILE records to a file. The
+default file is
.I mft
-which will be created in the current directory. This option can
-be combined with the
+which will be created in the current directory. This option can be combined
+with the
.B \-\-output
and
@@ -218,20 +245,47 @@
.B ntfsundelete.
.SH EXAMPLES
-.SH CAVEATS
-.SS Miracles
-.SS Extended MFT Records
-.B ntfsundelete
-cannot perform miracles.
-Even if a file is entirely within unused portions of the disk, it does not
-guarantee that the file hasn't been partially overwritten.
-read only
-locale
-extended mft records != file framentation
-if you find this tool useful
-potential, no guarantee
+.TP
+Look for deleted files on /dev/hda1.
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1
+.RE
+.TP
+Look for deleted documents on /dev/hda1.
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1 -s \-m '*.doc'
+.RE
+.TP
+Look for deleted files between 5000 and 6000000 bytes, with at least 90% of the data recoverable, on /dev/hda1.
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1 \-S 5k\-6m \-p 90
+.RE
+.TP
+Look for deleted files altered in the last two days
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1 \-t 2d
+.RE
+.TP
+Undelete inode number 3689, call the file 'work.doc' and put it in the user's home directory.
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1 \-u 3689 \-o work.doc \-d ~
+.RE
+.TP
+Save MFT Records 3689 to 3690 to a file 'debug'
+.RS 4
+.TP
+.B ntfsundelete /dev/hda1 \-c 3689\-3690 \-o debug
.SH BUGS
+There are some small limitations to this program, but currently no known bugs.
+If you find one, please email the author and let him know.
.SH AUTHOR
.B ntfsundelete
was written by Richard Russon (FlatCap) <nt...@fl...>
+.br
+If you find this tool useful, please send him an email :\-)
.SH AVAILABILITY
.B ntfsundelete
|