[Bradford] Recovering "missing" files from NTFS

[David Spencer]

Well there are multiple do's and dont's depending on what happened.
If files have been deleted due to operator error, you'll need to do
*nothing* to the fs before using something like photorec or some
undelete thingie.
If it's a hard error on the disk (smartctl -a) you'll need to run
ddrescue and work on the image and then identify which files were
gonged, there's plenty about that online (basically you need to map
the bad block address into the the ntfs inode, or you can fill the bad
blocks with something you can grep).
If it's some kind of ntfs cockup (system crash corrupted the fs, etc)
then the problem you'll find is that the Linux ntfs implementation
hasn't got a fully functional fsck and you will get better results
from running checkdsk in the recovery console.
In all three cases I would start with making a ddrescue image and take
it from there...

This message brought to you by the Virgin Media business broadband
fault line hold music.

tarra
-D.