Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a feeling the answer to this is right in front of me, but I am not seeing it. :/

I used dd to to create an image of a failing drive. Now, I would like to attempt to recover anything I can from an NTFS partition on the drive using ntfsundelete

The problem is that I don't understand how to specify the NTFS partition(mounted or not) as input for ntfsundelete.

I have mounted the NTFS partition(specified the block offset) on a loopback, /mnt/myhdd

Any help would be appreciated.


share|improve this question
up vote 3 down vote accepted

The manpage for ntfsundelete says it works on devices, not mounted filesystems. You would need unmount /mnt/myhdd and run ntfsundelete on /dev/loop0, or whichever loop device you set up.

Obviously you want -u. It might be that you need to specify -m as well in order to get anything to happen. E.g. -m <filename>. After running -s previously to look for available filenames. -m * to undelete all available files might be necessary if you have a lot, but that might be a bit painful.

share|improve this answer
@Jonathan remembering to unmount the filesystem first! – sourcejedi Feb 17 '13 at 16:21
Ahhh... Will try this as soon as I get back to my computer and report back. – Jonathan Feb 17 '13 at 16:29
Sorry, I never made it back here to accept this answer. I ended up getting it to work because of your answer. Thanks for the help! Hope you had a nice year. ;) – Jonathan Mar 12 '14 at 18:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.