As far as I can tell from the manpage of ntfsundelete getting a file back is done with e.g.

ntfsundelete /dev/sdb3 -u -m important.txt

which would undelete the file in-place. If I don't want in-place mode I see this option

-d, --destination DIR  Destination directory

but when I use it -d /tmp/win it thinks it is a regex.

How should -d be used?

2 Answers 2


I'm the co-author (h. ohmacht) of ntfsundelete. An example usage is:

ntfsundelete -u -m "*" -d "/root/recovery" /dev/sda1

will recover any file on /dev/sda1 to directory /root/recovery; this is the best way.


I found this blog with a title posted: ntfsundelete - Undeleting NTFS files, and the following example:

$ sudo ntfsundelete /dev/sda2 -u -m '*.mp3' -p 100 -t 5m \
     -d /media/externalExt3/undeleted

Are you using sudo when you run your command?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.