As far as I can tell from the manpage of
ntfsundelete getting a file back is done with e.g.
ntfsundelete /dev/sdb3 -u -m important.txt
which would undelete the file in-place. If I don't want in-place mode I see this option
-d, --destination DIR Destination directory
but when I use it
-d /tmp/win it thinks it is a regex.
-d be used?