[Cialug] NTFS undelete

[Jared Brees]

Why not just run it under Windows if that's a concern?

Why do you need the extra attributes? Generally recovery tools are there to get the data, not all the metadata. I generally don't even get file names, just the files themselves.
________________________________
From: Cialug <cialug-bounces at cialug.org> on behalf of L. V. Lammert <lvl at omnitec.net>
Sent: Wednesday, June 22, 2022 13:23
To: Central Iowa Linux Users Group <cialug at cialug.org>
Subject: Re: [Cialug] NTFS undelete

On Wed, 22 Jun 2022, Scott Yates wrote:

> If you can mount the drive at a block level, I don't see what advantage
> there would be to "windows drivers".  The recovery software typically has
> to access the device at the block level either way.  Did your friend
> indicate what additional help that would provide?
>
Supposedly there a number of file system attributes that are not available
to non-MS NTFS tools that can obfuscates the components of a file that has
been deleted (and other proprietary cruft).

It makes sense in that testdisk only found a few hundred deleted filies,
.. whereas there should be many more actually part of the NTFS file
system on a normal workstation.

        Lee
_______________________________________________
Cialug mailing list
Cialug at cialug.org
https://www.cialug.org/cgi-bin/mailman/listinfo/cialug