From e6eec7354123ff726720208d06308509862a9677 Mon Sep 17 00:00:00 2001 From: "flatcap.org!flatcap" Date: Thu, 5 Dec 2002 14:22:26 +0000 Subject: [PATCH] caveat: the filesize and date/time might not be what you expected (Logical change 1.29) --- ntfsprogs/ntfsundelete.8.in | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/ntfsprogs/ntfsundelete.8.in b/ntfsprogs/ntfsundelete.8.in index c6a0aee2..160afe19 100644 --- a/ntfsprogs/ntfsundelete.8.in +++ b/ntfsprogs/ntfsundelete.8.in @@ -73,6 +73,19 @@ with data. .B ntfsundelete cannot recover compressed or encrypted files. When scanning for them, it will display as being 0% recoverable. +.SS The Recovered File's Size and Date +To recover a file +.B ntfsundelete +has to read the file's metadata. Unfortunately, this isn't always intact. +When a file is deleted, the metadata can be left in an inconsistant state. e.g. +the file size may be zero; the dates of the file may be set to the time it was +deleted, or random. +.br +To be safe +.B ntfsundelete +will pick the largest file size it finds and write that to disk. It will also +try and set the file's date to the last modified date. This date may be the +correct last modified date, or something unexpected. .SH OPTIONS Below is a summary of all the options that .B ntfsundelete