caveat: the filesize and date/time might not be what you expected

(Logical change 1.29)
edge.strict_endians
flatcap.org!flatcap 2002-12-05 14:22:26 +00:00
parent e6d4f5ea45
commit e6eec73541
1 changed files with 13 additions and 0 deletions

View File

@ -73,6 +73,19 @@ with data.
.B ntfsundelete
cannot recover compressed or encrypted files. When scanning for them, it will
display as being 0% recoverable.
.SS The Recovered File's Size and Date
To recover a file
.B ntfsundelete
has to read the file's metadata. Unfortunately, this isn't always intact.
When a file is deleted, the metadata can be left in an inconsistant state. e.g.
the file size may be zero; the dates of the file may be set to the time it was
deleted, or random.
.br
To be safe
.B ntfsundelete
will pick the largest file size it finds and write that to disk. It will also
try and set the file's date to the last modified date. This date may be the
correct last modified date, or something unexpected.
.SH OPTIONS
Below is a summary of all the options that
.B ntfsundelete