Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
NTFS undelete session highlights
# List deleted files from the MFT, sort by date
sudo ntfsundelete /dev/sdb1 | sort -n -r -k4 | \
# Construct commands to undelete each INODE to ~${date}/${inode}-{filename}
awk '{print "sudo ntfsundelete -u /dev/sdb1 -i " $1 " -o \"/run/media/fdupanovic/WD/" $4 "/" $1 "-" $7 "\"";}' | \
# Truncate day from dates
sed -r "s/-[0-9]+//2" | \
# Split into files with 2048 commands each to avoid memory segmentation errors
split -l 2048
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.