Recover many files using ntfsundelete

Question

I am using the following command to scan for deleted files:

sudo ntfsundelete /dev/sda1 -S 400m-20g -p 100

How can I restore the all of the results?

I have tried:

sudo ntfsundelete /dev/sda1 -u 400m-20g -p 100 -d /mnt/bigboy/ntfs

returns You must specify exactly one device.

and also:

sudo ntfsundelete /dev/sda1 -u -i 44-6057 -p 100 -d /mnt/bigboy/ntfs

which seems to only recover the first file, and then outputs:

Couldn't create output file: File exists

I believe the latter is caused by the fact that for some reason I have lost all of the file nanes. (The drive was shut down immediately, so not sure how.)

Any help would be most appreciated.

Answer 1

I've been struggling with this myself for a while. specifying -u -m *.jpg will restore all jpg files, but the pattern matching in ntfsdelete is a bit weird, so specifying -m * will just print

You must specify exactly one device.

Instead you have to enclose the pattern in quotes for * or *.* to work.

So to sum it up, what worked for me was the following command:

sudo ntfsundelete /dev/sdb2 -u -m "*"