Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a feeling the answer to this is right in front of me, but I am not seeing it. :/

I used dd to to create an image of a failing drive. Now, I would like to attempt to recover anything I can from an NTFS partition on the drive using ntfsundelete

The problem is that I don't understand how to specify the NTFS partition(mounted or not) as input for ntfsundelete.

I have mounted the NTFS partition(specified the block offset) on a loopback, /mnt/myhdd

Any help would be appreciated.

Thanks.

share|improve this question
up vote 3 down vote accepted

The manpage for ntfsundelete says it works on devices, not mounted filesystems. You would need unmount /mnt/myhdd and run ntfsundelete on /dev/loop0, or whichever loop device you set up.

Obviously you want -u. It might be that you need to specify -m as well in order to get anything to happen. E.g. -m <filename>. After running -s previously to look for available filenames. -m * to undelete all available files might be necessary if you have a lot, but that might be a bit painful.

share|improve this answer
1  
@Jonathan remembering to unmount the filesystem first! – sourcejedi Feb 17 '13 at 16:21
    
Ahhh... Will try this as soon as I get back to my computer and report back. – Jonathan Feb 17 '13 at 16:29
    
Sorry, I never made it back here to accept this answer. I ended up getting it to work because of your answer. Thanks for the help! Hope you had a nice year. ;) – Jonathan Mar 12 '14 at 18:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .