Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using the following command to scan for deleted files:

sudo ntfsundelete /dev/sda1 -S 400m-20g -p 100

How can I restore the all of the results?

I have tried:

sudo ntfsundelete /dev/sda1 -u 400m-20g -p 100 -d /mnt/bigboy/ntfs

returns You must specify exactly one device.

and also:

sudo ntfsundelete /dev/sda1 -u -i 44-6057 -p 100 -d /mnt/bigboy/ntfs

which seems to only recover the first file, and then outputs:

Couldn't create output file: File exists

I believe the latter is caused by the fact that for some reason I have lost all of the file nanes. (The drive was shut down immediately, so not sure how.)

Any help would be most appreciated.

share|improve this question

I've been struggling with this myself for a while. specifying -u -m *.jpg will restore all jpg files, but the pattern matching in ntfsdelete is a bit weird, so specifying -m * will just print

You must specify exactly one device.

Instead you have to enclose the pattern in quotes for * or *.* to work.

So to sum it up, what worked for me was the following command:

sudo ntfsundelete /dev/sdb2 -u -m "*"
share|improve this answer

you only need to know how bash expansion and substitution works hence you will pass the correct arguments to ntfsundelete.

its important that you understand how does bash work when it comes to parameters and wildcards. otherwise youll be continuously misusing many console programs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.