From bcbd157cfcbca2765032c7d40012ab34de89b59f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jean-Pierre=20Andr=C3=A9?= Date: Tue, 30 Jul 2013 11:00:46 +0200 Subject: [PATCH] Output the modification time when scanning files by ntfsundelete When trying to undelete a file which was modified several times the same day, it is difficult to tell which one is the latest unless the modification time is displayed. --- ntfsprogs/ntfsundelete.8.in | 10 +++++----- ntfsprogs/ntfsundelete.c | 12 +++++++----- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/ntfsprogs/ntfsundelete.8.in b/ntfsprogs/ntfsundelete.8.in index 6ef80e15..f80a4d75 100644 --- a/ntfsprogs/ntfsundelete.8.in +++ b/ntfsprogs/ntfsundelete.8.in @@ -187,8 +187,8 @@ options, respectively. The output of scan will be: .sp .nf -Inode Flags %age Date Size Filename - 6038 FN.. 93% 2002\-07\-17 26629 thesis.doc +Inode Flags %age Date Time Size Filename + 6038 FN.. 93% 2002\-07\-17 13:42 26629 thesis.doc .fi .TS box; @@ -283,11 +283,11 @@ Undelete inodes 2, 5 and 100 to 131 of device /dev/sda1 .B ntfsundelete /dev/sda1 \-u \-i 2,5,100\-131 .sp .RE -Undelete inode number 3689, call the file 'work.doc' and put it in the user's -home directory. +Undelete inode number 3689, call the file 'work.doc', set it to recovered +size and put it in the user's home directory. .RS .sp -.B ntfsundelete /dev/hda1 \-u \-i 3689 \-o work.doc \-d ~ +.B ntfsundelete /dev/hda1 \-u \-T \-i 3689 \-o work.doc \-d ~ .sp .RE Save MFT Records 3689 to 3690 to a file 'debug' diff --git a/ntfsprogs/ntfsundelete.c b/ntfsprogs/ntfsundelete.c index 908b22f9..4a9b3ec5 100644 --- a/ntfsprogs/ntfsundelete.c +++ b/ntfsprogs/ntfsundelete.c @@ -5,6 +5,7 @@ * Copyright (c) 2004-2005 Holger Ohmacht * Copyright (c) 2005 Anton Altaparmakov * Copyright (c) 2007 Yura Pakhuchiy + * Copyright (c) 2013 Jean-Pierre Andre * * This utility will recover deleted files from an NTFS volume. * @@ -390,7 +391,8 @@ static void version(void) ntfs_log_info("Copyright (c) 2002-2005 Richard Russon\n" "Copyright (c) 2004-2005 Holger Ohmacht\n" "Copyright (c) 2005 Anton Altaparmakov\n" - "Copyright (c) 2007 Yura Pakhuchiy\n"); + "Copyright (c) 2007 Yura Pakhuchiy\n" + "Copyright (c) 2013 Jean-Pierre Andre\n"); ntfs_log_info("\n%s\n%s%s\n", ntfs_gpl, ntfs_bugs, ntfs_home); } @@ -1656,7 +1658,7 @@ static void dump_record(struct ufile *file) * * Print a one line description of a file. * - * Inode Flags %age Date Size Filename + * Inode Flags %age Date Time Size Filename * * The output will contain the file's inode number (MFT Record), some flags, * the percentage of the file that is recoverable, the last modification date, @@ -1683,7 +1685,7 @@ static void list_record(struct ufile *file) char flagd = '.', flagr = '.', flagc = '.', flagx = '.'; - strftime(buffer, sizeof(buffer), "%F", localtime(&file->date)); + strftime(buffer, sizeof(buffer), "%F %R", localtime(&file->date)); if (file->attr_list) flagx = '!'; @@ -2219,8 +2221,8 @@ static int scan_disk(ntfs_volume *vol) nr_mft_records = vol->mft_na->initialized_size >> vol->mft_record_size_bits; - ntfs_log_quiet("Inode Flags %%age Date Size Filename\n"); - ntfs_log_quiet("---------------------------------------------------------------\n"); + ntfs_log_quiet("Inode Flags %%age Date Time Size Filename\n"); + ntfs_log_quiet("-----------------------------------------------------------------------\n"); for (i = 0; i < bmpsize; i += BUFSIZE) { long long read_count = min((bmpsize - i), BUFSIZE); size = ntfs_attr_pread(attr, i, read_count, buffer);