How to use -d in ntfsundelete?

Question

As far as I can tell from the manpage of ntfsundelete getting a file back is done with e.g.

ntfsundelete /dev/sdb3 -u -m important.txt

which would undelete the file in-place. If I don't want in-place mode I see this option

-d, --destination DIR  Destination directory

but when I use it -d /tmp/win it thinks it is a regex.

How should -d be used?

Answer 1

I found this blog with a title posted: ntfsundelete - Undeleting NTFS files, and the following example:

$ sudo ntfsundelete /dev/sda2 -u -m '*.mp3' -p 100 -t 5m \
     -d /media/externalExt3/undeleted

Are you using sudo when you run your command?

Answer 2

I'm the co-author (h. ohmacht) of ntfsundelete. An example usage is:

ntfsundelete -u -m "*" -d "/root/recovery" /dev/sda1

will recover any file on /dev/sda1 to directory /root/recovery; this is the best way.