NTFSRECOVER(8) | System Manager's Manual | NTFSRECOVER(8) |
ntfsrecover - Recover updates committed by Windows on an NTFS volume
ntfsrecover [options] device
ntfsrecover applies to the metadata the updates which were requested on Windows but could not be completed because they were interrupted by some event such as a power failure, a hardware crash, a software crash or the device being unplugged. Doing so, the file system is restored to a consistent state, however updates to user data may still be lost.
Updating the file system generally requires updating several records which should all be made for the file system to be kept consistent. For instance, creating a new file requires reserving an inode number (set a bit in a bit map), creating a file record (store the file name and file attributes), and registering the file in a directory (locate the file from some path). When an unfortunate event occurs, and one of these updates could be done but not all of them, the file system is left inconsistent.
A group of updates which have all to be done to preserve consistency is called a transaction, and the end of updates within a transaction is called the commitment of the transaction.
To protect from unfortunate events, Windows first logs in a special file all the metadata update requests without applying any, until the commitment is known. If the event occurs before the commitment, no update has been made and the file system is consistent. If the event occurs after the update, the log file can be analyzed later and the transactions which were committed can be executed again, thus restoring the integrity of the file system.
ntfsrecover similarly examines the log file and applies the updates within committed transactions which could not be done by Windows.
Currently, ntfs-3g does not log updates, so ntfsrecover cannot be used to restore consistency after an unfortunate event occurred while the file system was updated by Linux.
Below is a summary of all the options that ntfsrecover accepts. The normal usage is to use no option at all, as most of these options are oriented towards developers needs.
Nearly all options have two equivalent names. The short name is preceded by - and the long name is preceded by --. Any single letter options, that don't take an argument, can be combined into a single command, e.g. -bv is equivalent to -b -v. Long named options can be abbreviated to any unique prefix of their name.
The option -s can be repeated to request applying the committed actions mentioned in the obsolete restart page. This is useful for testing the situations where the latest restart page cannot be read though it can actually be read.
Sync an NTFS volume on /dev/sda1.
ntfsrecover -s /dev/sda1
ntfsrecover --verbose --backward --clusters=100-119 /dev/sda1
If you find a bug please send an email describing the problem to
the development team:
ntfs-3g-devel@lists.sf.net
ntfsrecover was written by Jean-Pierre Andre
ntfsrecover is part of the ntfs-3g package and is
available from:
http://www.tuxera.com/community/
September 2015 | ntfs-3g 2017.3.23AR.3 |