As far as I can tell from the manpage of ntfsundelete
getting a file back is done with e.g.
ntfsundelete /dev/sdb3 -u -m important.txt
which would undelete the file in-place. If I don't want in-place mode I see this option
-d, --destination DIR Destination directory
but when I use it -d /tmp/win
it thinks it is a regex.
How should -d
be used?