From 1b5590613265bcd03f1bc1165742546713e4a6a1 Mon Sep 17 00:00:00 2001 From: flatcap Date: Thu, 10 Nov 2005 03:20:47 +0000 Subject: [PATCH] -u now just means undelete -i, --inodes takes a range of inodes to be recovered remove interactive option (it wasn't implemented) --- ntfsprogs/ntfsundelete.8.in | 63 ++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 29 deletions(-) diff --git a/ntfsprogs/ntfsundelete.8.in b/ntfsprogs/ntfsundelete.8.in index a90c327a..9af80533 100644 --- a/ntfsprogs/ntfsundelete.8.in +++ b/ntfsprogs/ntfsundelete.8.in @@ -1,4 +1,4 @@ -.\" Copyright (c) 2002 Richard Russon. All Rights Reserved. +.\" Copyright (c) 2002-2005 Richard Russon. All Rights Reserved. .\" This file may be copied under the terms of the GNU Public License. .\" .TH NTFSUNDELETE 8 "June 2002" "ntfsprogs version @VERSION@" @@ -101,11 +101,11 @@ is equivalent to .BR "\-f \-v" . Long named options can be abbreviated to any unique prefix of their name. .TP -.BI "\-b " num +.BI "\-b " NUM .br .ns .TP -.BI "\-\-byte " num +.BI "\-\-byte " NUM If any clusters of the file cannot be recovered, the missing parts will be filled with this byte. The default is zeros. .TP @@ -118,11 +118,11 @@ When scanning an NTFS volume, any filename matching (using the .B \-\-match option) is case\-insensitive. This option makes the matching case\-sensitive. .TP -.BI "\-c " range +.BI "\-c " RANGE .br .ns .TP -.BI "\-\-copy " range +.BI "\-\-copy " RANGE This wizard's option will write a block of MFT FILE records to a file. The default file is .I mft @@ -133,11 +133,11 @@ and .B \-\-destination options. .TP -.BI "\-d " dir +.BI "\-d " DIR .br .ns .TP -.BI "\-\-destination " dir +.BI "\-\-destination " DIR This option controls where to put the output file of the .B \-\-undelete and @@ -159,19 +159,21 @@ file. Use this option with caution. .B \-\-help Show a list of options with a brief description of each one. .TP -.B \-i +.BI "\-i " RANGE .br .ns .TP -.B \-\-interactive -Switches the interactive mode, meaning that for each undeleting of a file -the user will be asked. +.BI "\-\-inodes " RANGE +Recover the files with these inode numbers. +.I RANGE +can be a single inode number, several numbers separated by commas "," or a +range separated by a dash "-". .TP -.BI "\-m " pattern +.BI "\-m " PATTERN .br .ns .TP -.BI "\-\-match " pattern +.BI "\-\-match " PATTERN Filter the output by only looking for matching filenames. The pattern can include the wildcards '?', match exactly one character or '*', match zero or more characters. By default the matching is case\-insensitive. To make the search @@ -179,22 +181,22 @@ case sensitive, use the .B \-\-case option. .TP -.BI "\-o " file +.BI "\-o " FILE .br .ns .TP -.BI "\-\-output " file +.BI "\-\-output " FILE Use this option to set name of output file that .B \-\-undelete or .B \-\-copy will create. .TP -.BI "\-p " num +.BI "\-p " NUM .br .ns .TP -.BI "\-\-percentage " num +.BI "\-\-percentage " NUM Filter the output of the .B \-\-scan option, by only matching files with a certain amount of recoverable content. @@ -248,11 +250,11 @@ The percentage field shows how much of the file can potentially be recovered. .sp .br .RE -.BI "\-S " range +.BI "\-S " RANGE .br .ns .TP -.BI "\-\-size " range +.BI "\-\-size " RANGE Filter the output of the .B \-\-scan option, by looking for a particular range of file sizes. The range may be @@ -260,11 +262,11 @@ specified as two numbers separated by a '\-'. The sizes may be abbreviated using the suffixes k, m, g, t, for kilobytes, megabytes, gigabytes and terabytes respectively. .TP -.BI "\-t " since +.BI "\-t " SINCE .br .ns .TP -.BI "\-\-time " since +.BI "\-\-time " SINCE Filter the output of the .B \-\-scan option. Only match files that have been altered since this time. The time must @@ -282,15 +284,18 @@ is confident about the size of a deleted file, then it will restore the file to exactly that size. The default behaviour is to round up the size to the nearest cluster (which will be a multiple of 512 bytes). .TP -.BI "\-u " [nums] +.BI "\-u " .br .ns .TP -.BI "\-\-undelete " [nums] -where is optional. Recover the files either by matching the -regular expression of option -m or by the given nums, which are the -inode numbers. You can specify more than one inode by separating with -"," or a range of inodes by using "-". This option can be combined with +.BI "\-\-undelete " +Select +.B undelete +mode. You can specify the files to be recovered using by using +.B --match +or +.B --inodes +options. This option can be combined with .BR \-\-output , .BR \-\-destination , and @@ -345,14 +350,14 @@ Look for deleted files altered in the last two days Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1 .RS .sp -.B ntfsundelete /dev/sda1 -u 2,5,100-131 +.B ntfsundelete /dev/sda1 -u -i 2,5,100-131 .sp .RE Undelete inode number 3689, call the file 'work.doc' and put it in the user's home directory. .RS .sp -.B ntfsundelete /dev/hda1 \-u 3689 \-o work.doc \-d ~ +.B ntfsundelete /dev/hda1 \-u -i 3689 \-o work.doc \-d ~ .sp .RE Save MFT Records 3689 to 3690 to a file 'debug'