227 lines
8.2 KiB
HTML
227 lines
8.2 KiB
HTML
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
|
<HTML><HEAD><TITLE>Man page of NTFSRECOVER</TITLE>
|
|
</HEAD><BODY>
|
|
<H1>NTFSRECOVER</H1>
|
|
Section: Maintenance Commands (8)<BR>Updated: September 2015<BR><A HREF="#index">Index</A>
|
|
<A HREF="/cgi-bin/man/man2html">Return to Main Contents</A><HR>
|
|
|
|
<A NAME="lbAB"> </A>
|
|
<H2>NAME</H2>
|
|
|
|
ntfsrecover - Recover updates committed by Windows on an NTFS volume
|
|
<A NAME="lbAC"> </A>
|
|
<H2>SYNOPSIS</H2>
|
|
|
|
<B>ntfsrecover</B> [<I>options</I>] <I>device</I>
|
|
<A NAME="lbAD"> </A>
|
|
<H2>DESCRIPTION</H2>
|
|
|
|
<B>ntfsrecover</B>
|
|
|
|
applies to the metadata the updates which were requested on Windows but could
|
|
not be completed because they were interrupted by some event such as a power
|
|
failure, a hardware crash, a software crash or the device being unplugged.
|
|
Doing so, the file system is restored to a consistent state, however updates
|
|
to user data may still be lost.
|
|
<P>
|
|
Updating the file system generally requires updating several records which
|
|
should all be made for the file system to be kept consistent. For instance,
|
|
creating a new file requires reserving an inode number (set a bit in a bit
|
|
map), creating a file record (store the file name and file attributes), and
|
|
registering the file in a directory (locate the file from some path). When an
|
|
unfortunate event occurs, and one of these updates could be done but not all
|
|
of them, the file system is left inconsistent.
|
|
<P>
|
|
A group of updates which have all to be done to preserve consistency is
|
|
called a transaction, and the end of updates within a transaction is called
|
|
the commitment of the transaction.
|
|
<P>
|
|
To protect from unfortunate events, Windows first logs in a special file all
|
|
the metadata update requests without applying any, until the commitment is
|
|
known. If the event occurs before the commitment, no update has been made and
|
|
the file system is consistent. If the event occurs after the update, the log
|
|
file can be analyzed later and the transactions which were committed can be
|
|
executed again, thus restoring the integrity of the file system.
|
|
<P>
|
|
<B>ntfsrecover</B>
|
|
|
|
similarly examines the log file and applies the updates within committed
|
|
transactions which could not be done by Windows.
|
|
<P>
|
|
Currently, ntfs-3g does not log updates, so
|
|
<B>ntfsrecover</B>
|
|
|
|
cannot be used to restore consistency after an unfortunate event occurred
|
|
while the file system was updated by Linux.
|
|
<P>
|
|
<A NAME="lbAE"> </A>
|
|
<H2>OPTIONS</H2>
|
|
|
|
Below is a summary of all the options that
|
|
<B>ntfsrecover</B>
|
|
|
|
accepts. The normal usage is to use no option at all, as most of these
|
|
options are oriented towards developers needs.
|
|
<P>
|
|
Nearly all options have two equivalent names. The short name is
|
|
preceded by
|
|
<B>-</B>
|
|
|
|
and the long name is preceded by
|
|
<B>--</B>.
|
|
|
|
Any single letter options, that don't take an argument, can be combined into a
|
|
single command, e.g.
|
|
<B>-bv</B>
|
|
|
|
is equivalent to
|
|
<B>-b -v</B>.
|
|
|
|
Long named options can be abbreviated to any unique prefix of their name.
|
|
<DL COMPACT>
|
|
<DT id="1"><B>-b</B>, <B>--backward</B><DD>
|
|
Examine the actions described in the logfile backward from the latest one to
|
|
the earliest one without applying any update. This may encompass records
|
|
generated during several sessions, and when Windows is restarted, it often
|
|
does not restart writing where it ended the previous session, so this leads
|
|
to errors and bad sequencing when examining the full log file.
|
|
<DT id="2"><B>-c</B>, <B>--clusters</B> <B>CLUSTER-RANGE</B><DD>
|
|
Restrict the output generated when using options -b -f -u -p
|
|
to the actions operating on a cluster within the given cluster range.
|
|
CLUSTER-RANGE is defined by the first and last cluster numbers separated
|
|
by a hyphen, for instance 100-109 or 0x3e8-0x3ff. A single number means
|
|
restricting to a single cluster. The first four log blocks have a special
|
|
role and they are always shown.
|
|
<DT id="3"><B>-f</B>, <B>--forward</B> <B>NUM</B><DD>
|
|
Examine the actions described in the logfile forward from the first one to
|
|
the last one without applying any update. As the log file is reused
|
|
circularly, the first one is generally not the earliest. Moreover when
|
|
Windows is restarted, it often does not restart writing where it ended the
|
|
previous sessions, and this leads to errors when examining a log file
|
|
generated during several sessions.
|
|
<DT id="4"><B>-h</B>, <B>--help</B><DD>
|
|
Show some help information.
|
|
<DT id="5"><B>-k</B>, <B>--kill-fast-restart</B><DD>
|
|
When Windows has been interrupted with fast restart mode activated,
|
|
part of pending changes are kept in the Windows cache and only the same
|
|
Windows version can recover them. This option can be used to apply the
|
|
changes recorded in the log file and drop the ones in the Windows cache.
|
|
This is dangerous and may cause loss of data.
|
|
<DT id="6"><B>-n</B>, <B>--no-action</B><DD>
|
|
Do not apply any modification, useful when using the options -p, -s or -u.
|
|
<DT id="7"><B>-p</B>, <B>--play</B> <B>COUNT</B><DD>
|
|
Undo COUNT transaction sets and redo a single one, a transaction set being
|
|
all transactions between two consecutive checkpoints. This is useful for
|
|
replaying some transaction in the past. As a few actions are not undoable,
|
|
this is not always possible.
|
|
<DT id="8"><B>-r</B>, <B>--range</B> <B>BLOCK-RANGE</B><DD>
|
|
Examine the actions described in the logfile forward restricted to the
|
|
requested log file block range without applying any update. The first four
|
|
log blocks have a special role and they are always examined.
|
|
<DT id="9"><B>-s</B>, <B>--sync</B><DD>
|
|
Sync the file system by applying the committed actions which have not
|
|
been synced previously. This is the default option, used when none of
|
|
the options -n, -f, -r, -p and -u are present.
|
|
<P>
|
|
The option -s can be repeated to request applying the committed actions
|
|
mentioned in the obsolete restart page. This is useful for testing the
|
|
situations where the latest restart page cannot be read though it can
|
|
actually be read.
|
|
<DT id="10"><B>-t</B>, <B>--transactions</B> <B>COUNT</B><DD>
|
|
Display the transaction parameters when examining the log file with one
|
|
of the options --forward, --backward or --range.
|
|
<DT id="11"><B>-u</B>, <B>--undo</B> <B>COUNT</B><DD>
|
|
Undo COUNT transaction sets, thus resetting the file system to some
|
|
checkpoint in the past, a transaction set being all transactions between
|
|
two consecutive checkpoints. As a few actions are not undoable, this is
|
|
not always possible.
|
|
<DT id="12"><B>-v</B>, <B>--verbose</B><DD>
|
|
Display more debug/warning/error messages. This option may be used twice
|
|
to display even more information.
|
|
<DT id="13"><B>-V</B>, <B>--version</B><DD>
|
|
Show the version number, copyright and license of
|
|
<B>ntfsrecover</B>.
|
|
|
|
</DL>
|
|
<A NAME="lbAF"> </A>
|
|
<H2>EXAMPLES</H2>
|
|
|
|
Sync an NTFS volume on /dev/sda1.
|
|
<DL COMPACT><DT id="14"><DD>
|
|
<P>
|
|
<B>ntfsrecover -s /dev/sda1</B>
|
|
|
|
<P>
|
|
</DL>
|
|
|
|
Display all actions which updated a cluster in range 100 to 119 :
|
|
<DL COMPACT><DT id="15"><DD>
|
|
<P>
|
|
<B>ntfsrecover --verbose --backward --clusters=100-119 /dev/sda1</B>
|
|
|
|
<P>
|
|
</DL>
|
|
|
|
<A NAME="lbAG"> </A>
|
|
<H2>BUGS</H2>
|
|
|
|
If you find a bug please send an email describing the problem to the
|
|
development team:
|
|
<BR>
|
|
|
|
|
|
<A HREF="mailto:ntfs-3g-devel@lists.sf.net">ntfs-3g-devel@lists.sf.net</A>
|
|
|
|
<A NAME="lbAH"> </A>
|
|
<H2>AUTHORS</H2>
|
|
|
|
<B>ntfsrecover</B>
|
|
|
|
was written by Jean-Pierre Andre
|
|
<A NAME="lbAI"> </A>
|
|
<H2>AVAILABILITY</H2>
|
|
|
|
<B>ntfsrecover</B>
|
|
|
|
is part of the
|
|
<B>ntfs-3g</B>
|
|
|
|
package and is available from:
|
|
<BR>
|
|
|
|
|
|
<A HREF="http://www.tuxera.com/community/">http://www.tuxera.com/community/</A>
|
|
|
|
<A NAME="lbAJ"> </A>
|
|
<H2>SEE ALSO</H2>
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ntfs-3g">ntfs-3g</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ntfsfix">ntfsfix</A></B>(8),
|
|
|
|
<B><A HREF="/cgi-bin/man/man2html?8+ntfsprogs">ntfsprogs</A></B>(8)
|
|
|
|
<P>
|
|
|
|
<HR>
|
|
<A NAME="index"> </A><H2>Index</H2>
|
|
<DL>
|
|
<DT id="16"><A HREF="#lbAB">NAME</A><DD>
|
|
<DT id="17"><A HREF="#lbAC">SYNOPSIS</A><DD>
|
|
<DT id="18"><A HREF="#lbAD">DESCRIPTION</A><DD>
|
|
<DT id="19"><A HREF="#lbAE">OPTIONS</A><DD>
|
|
<DT id="20"><A HREF="#lbAF">EXAMPLES</A><DD>
|
|
<DT id="21"><A HREF="#lbAG">BUGS</A><DD>
|
|
<DT id="22"><A HREF="#lbAH">AUTHORS</A><DD>
|
|
<DT id="23"><A HREF="#lbAI">AVAILABILITY</A><DD>
|
|
<DT id="24"><A HREF="#lbAJ">SEE ALSO</A><DD>
|
|
</DL>
|
|
<HR>
|
|
This document was created by
|
|
<A HREF="/cgi-bin/man/man2html">man2html</A>,
|
|
using the manual pages.<BR>
|
|
Time: 00:06:14 GMT, March 31, 2021
|
|
</BODY>
|
|
</HTML>
|