From man ntfsundelete
Look for deleted files altered in the last two days
ntfsundelete /dev/hda1 -t 2d
I wonder what altering files/directories mean?
-
Does deleting some files/directories count as altering them?
For example,
if I created a file more than two days ago, and didn't change it
until yesterday when I deleted. Will the command be able to recover
it? - Does moving some files/directories from being under a directory to being under another directory
count as altering them, even when the files/directories being moved
have not been changed themselves?
I am hoping to find a way to specify and undelete the directories (with files inside) that I deleted at once last time.
Thanks!
Best Answer
I'll try to answer your questions in a different order. What does altering a file mean ?
Altering means whenever you modify and update the content of the file (modify in linux). If we look at ntfsundelete source code we can clearly see what the authors have marked as alter:
ntfsundelete.h line 72:
ntfsundelete.c line 1002, 1045:
last_data_change_time is also explained in linux/fs/ntfs/inode.c line 674:
Question nr. 2:
List of actions that change a directory modification time:
Linux
Windows
Question nr.1:
No, deleting a file does not count as altering it. So if you created a file more than two days ago and didn't change it until yesterday when you deleted it the command won't be able to recover it.
Here is a test on my NTFS partition. I had three .jpg files with mtime as follows:
I modified IMG_2001.JPG with MSPaint and saved it so modification time changed to today: 2012-08-26. I then deleted (SHIF+DELETE) all three files and rebooted in Linux.
Running ntfsundelete without --time switch (altered time not taken into account) prints out a long list of files starting with the above three files:
Running ntfsundelete with --time d1 switch (so for files altered in the last 1 day) prints out only one file, namely the one I have just modified before deleting all three of them: