-u now just means undelete

-i, --inodes takes a range of inodes to be recovered
remove interactive option (it wasn't implemented)
edge.strict_endians
flatcap 2005-11-10 03:20:47 +00:00
parent 6e9be81f55
commit 1b55906132
1 changed files with 34 additions and 29 deletions

View File

@ -1,4 +1,4 @@
.\" Copyright (c) 2002 Richard Russon. All Rights Reserved.
.\" Copyright (c) 2002-2005 Richard Russon. All Rights Reserved.
.\" This file may be copied under the terms of the GNU Public License.
.\"
.TH NTFSUNDELETE 8 "June 2002" "ntfsprogs version @VERSION@"
@ -101,11 +101,11 @@ is equivalent to
.BR "\-f \-v" .
Long named options can be abbreviated to any unique prefix of their name.
.TP
.BI "\-b " num
.BI "\-b " NUM
.br
.ns
.TP
.BI "\-\-byte " num
.BI "\-\-byte " NUM
If any clusters of the file cannot be recovered, the missing parts will be
filled with this byte. The default is zeros.
.TP
@ -118,11 +118,11 @@ When scanning an NTFS volume, any filename matching (using the
.B \-\-match
option) is case\-insensitive. This option makes the matching case\-sensitive.
.TP
.BI "\-c " range
.BI "\-c " RANGE
.br
.ns
.TP
.BI "\-\-copy " range
.BI "\-\-copy " RANGE
This wizard's option will write a block of MFT FILE records to a file. The
default file is
.I mft
@ -133,11 +133,11 @@ and
.B \-\-destination
options.
.TP
.BI "\-d " dir
.BI "\-d " DIR
.br
.ns
.TP
.BI "\-\-destination " dir
.BI "\-\-destination " DIR
This option controls where to put the output file of the
.B \-\-undelete
and
@ -159,19 +159,21 @@ file. Use this option with caution.
.B \-\-help
Show a list of options with a brief description of each one.
.TP
.B \-i
.BI "\-i " RANGE
.br
.ns
.TP
.B \-\-interactive
Switches the interactive mode, meaning that for each undeleting of a file
the user will be asked.
.BI "\-\-inodes " RANGE
Recover the files with these inode numbers.
.I RANGE
can be a single inode number, several numbers separated by commas "," or a
range separated by a dash "-".
.TP
.BI "\-m " pattern
.BI "\-m " PATTERN
.br
.ns
.TP
.BI "\-\-match " pattern
.BI "\-\-match " PATTERN
Filter the output by only looking for matching filenames. The pattern can include the
wildcards '?', match exactly one character or '*', match zero or more
characters. By default the matching is case\-insensitive. To make the search
@ -179,22 +181,22 @@ case sensitive, use the
.B \-\-case
option.
.TP
.BI "\-o " file
.BI "\-o " FILE
.br
.ns
.TP
.BI "\-\-output " file
.BI "\-\-output " FILE
Use this option to set name of output file that
.B \-\-undelete
or
.B \-\-copy
will create.
.TP
.BI "\-p " num
.BI "\-p " NUM
.br
.ns
.TP
.BI "\-\-percentage " num
.BI "\-\-percentage " NUM
Filter the output of the
.B \-\-scan
option, by only matching files with a certain amount of recoverable content.
@ -248,11 +250,11 @@ The percentage field shows how much of the file can potentially be recovered.
.sp
.br
.RE
.BI "\-S " range
.BI "\-S " RANGE
.br
.ns
.TP
.BI "\-\-size " range
.BI "\-\-size " RANGE
Filter the output of the
.B \-\-scan
option, by looking for a particular range of file sizes. The range may be
@ -260,11 +262,11 @@ specified as two numbers separated by a '\-'. The sizes may be abbreviated
using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes
respectively.
.TP
.BI "\-t " since
.BI "\-t " SINCE
.br
.ns
.TP
.BI "\-\-time " since
.BI "\-\-time " SINCE
Filter the output of the
.B \-\-scan
option. Only match files that have been altered since this time. The time must
@ -282,15 +284,18 @@ is confident about the size of a deleted file, then it will restore the file to
exactly that size. The default behaviour is to round up the size to the nearest
cluster (which will be a multiple of 512 bytes).
.TP
.BI "\-u " [nums]
.BI "\-u "
.br
.ns
.TP
.BI "\-\-undelete " [nums]
where <nums> is optional. Recover the files either by matching the
regular expression of option -m or by the given nums, which are the
inode numbers. You can specify more than one inode by separating with
"," or a range of inodes by using "-". This option can be combined with
.BI "\-\-undelete "
Select
.B undelete
mode. You can specify the files to be recovered using by using
.B --match
or
.B --inodes
options. This option can be combined with
.BR \-\-output ,
.BR \-\-destination ,
and
@ -345,14 +350,14 @@ Look for deleted files altered in the last two days
Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1
.RS
.sp
.B ntfsundelete /dev/sda1 -u 2,5,100-131
.B ntfsundelete /dev/sda1 -u -i 2,5,100-131
.sp
.RE
Undelete inode number 3689, call the file 'work.doc' and put it in the user's
home directory.
.RS
.sp
.B ntfsundelete /dev/hda1 \-u 3689 \-o work.doc \-d ~
.B ntfsundelete /dev/hda1 \-u -i 3689 \-o work.doc \-d ~
.sp
.RE
Save MFT Records 3689 to 3690 to a file 'debug'