I want to use ntfsundelete to maintain the directory structure of the recovered files. The output of ntfsundelete is like this:

Inode    Flags  %age  Date            Size  Filename
191321   FN..   100%  2016-04-26      1175  file.txt
191322   D...   100%  2016-04-26        10  my directory

The output doesn't show the full path of 'file.txt', just its inode. So, how can I find the inode of its parent directory?


Have you tried the --parent parameter, as described in the ntfsundelete man page?

Since it was able to find the information from the folder that initially included it, that should normally work.

  • Yes, I tried the --parameter, but it just displays the name of the parent directory. This makes some confusion as the same name may be used for different parent directories inside the root directory but at different levels such as (/media/new-files and /media/gadgets/new-files). The files inside both of them would appear as if they belong to the same parent directory. This is why I need the inode (of the absolute path) of the parent not just its name. – Osama Salah Apr 26 '16 at 19:42

Inodes don't have parent information, that is why directory entry and inodes are separate. It's directory entries (or dentry) which have parents.

The reason for above is to support hardlinks. Since hardlinks point to the same inode, they can be under different directories(parents).


Trinity Rescue Kit has a utility called ntfsundeleteall which is described as

a simple wrapper for the utility 'ntfsundelete' ... it prepends the original inode (=internal number for the file on the filesystem) before the filename, so you always have a unique filename. It's up to you to rename the files afterwards, but at least you have the original name in the recovered filename.

You can use it by downloading the TRK disk and booting from it. Unfortunately I haven't been able to find the source of this wrapper script. It's not hard to imagine a bash script which would create folders based on the iNode names reported by ntfsundelete --scan, maybe even make optimistic guesses about files and folders based on consecutive iNode numbers... But it's hard to write it, and I can't find anybody who has.

  • 1
    The ntfsundeleteall utility doesn't recover the full path, too. As described at its page: It 's a good utility that recovers your files with the original filename but without the relevant path in front. – Osama Salah Jun 10 '17 at 12:50
  • You're right. I've just written a script which attempts to make some intelligent guesses at the answer. I'll push it to GitHub then make another answer... – andrew lorien Jun 12 '17 at 7:32

You can use find(1), eg :

find ./ -inum 191321

Might be a bit slow, though.

  • ntfsundelete works only on unmounted partitions. So, you cannot use find. Furthermore, even if you mounted the target partition, find would find nothing as the file no longer exists in the inode table. – Osama Salah Jun 10 '17 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.