Recover many files using ntfsundelete

Question

I am using the following command to scan for deleted files:

sudo ntfsundelete /dev/sda1 -S 400m-20g -p 100

How can I restore the all of the results?

I have tried:

sudo ntfsundelete /dev/sda1 -u 400m-20g -p 100 -d /mnt/bigboy/ntfs

returns You must specify exactly one device.

and also:

sudo ntfsundelete /dev/sda1 -u -i 44-6057 -p 100 -d /mnt/bigboy/ntfs

which seems to only recover the first file, and then outputs:

Couldn't create output file: File exists

I believe the latter is caused by the fact that for some reason I have lost all of the file nanes. (The drive was shut down immediately, so not sure how.)

Any help would be most appreciated.

Solution

I struggled with this myself for a while.

You have to use the -m option, which allows you to specify a pattern for files to work on. Enclose the pattern in quotes if you want *, *.jpg or *.* etc to work (or else your shell will do the matching in the current directory instead of passing the pattern to ntfs-undelete).

To sum it up, what worked for me was the following command:

sudo ntfsundelete /dev/sdb2 -u -m '*'