scrounge-ntfs(8)

📦
version 0.9 · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💾 scrounge-ntfs — the rescue mission manpage

okay bestie, welcome to scrounge-ntfs(8), straight out of the System Manager's Manual. this little icon is a utility that helps retrieve data from corrupted NTFS partitions. yes, corrupted. yes, NTFS. we're doing surgery on a dying disk and we're doing it with vibes. 🩺✨

✨ SYNOPSIS ✨

scrounge-ntfs -l disk
scrounge-ntfs -s disk
scrounge-ntfs [-m mftoffset] [-c clustersize] [-o outdir] disk start end

three whole modes, three whole moods. pick your fighter. 💅

🌸 DESCRIPTION 🌸

so like, scrounge-ntfs is the utility that can rescue data from corrupted NTFS partitions. it takes the files it retrieved and writes them out to another working file system, because we are not writing them back onto the crime scene. 🚫

heads up tho: certain information about the partition needs to be known in advance. it's giving "do your homework before the exam," not "improvise and hope." 📚

the -l mode is meant to be run in advance of the data corruption, with the output stored away in a file. that's the main character move — it lets scrounge-ntfs recover data reliably later. if you didn't do that... it's fine, it's fine, go read the 'NOTES' section below for the recover info when that isn't the case. 🫶

💅 OPTIONS 💅

the options are as follows, bestie:

  • -c — the cluster size (in sectors). when you don't specify it, a default of 8 is used. eight. iconic number. don't question it. 🎀
  • -l — list partition information for a drive. this will only work when the partition table for the given drive is intact. no table, no list, no cap. 😭
  • -m — when recovering data, this specifies the location of the MFT from the beginning of the partition (in sectors). if you don't specify it, then no directory information can be used — that is, all rescued files will be written to the same directory. one big folder. chaos pile. 🗂️
  • -o — directory to put rescued files in. if you don't specify it, then files will be placed in the current directory. (yes, the one you're standing in. yes, right there. 👀)
  • -s — search disk for partition information. (not implemented yet). bestie it is literally not there. someday. 🙈
  • disk — the raw device used to access the disk which contains the NTFS partition to rescue files from. eg: /dev/hdc. raw device energy only, we are not playing around. ⚡
  • start — the beginning of the NTFS partition (in sectors).
  • end — the end of the NTFS partition (in sectors).

📝 NOTES 📝

if you plan on using this program successfully you should prepare in advance by storing a copy of the partition information. use the -l option to do this. it's the pregame, it's the stretch before the run, it's the "charge your phone before the concert." 🔋

eventually, searching for disk partition information will be implemented, which will solve this problem. eventually. 🕰️

when only one partition exists on a disk, or you want to rescue the first partition, there are ways to guess at the sector sizes and MFT location. lowkey detective work. see the scrounge-ntfs web page for more info:

http://thewalter.net/stef/software/scrounge

👑 AUTHOR 👑

Stef Walter <stef@thewalter.net> — the legend, the blueprint, the whole reason this exists. 🙇‍♀️

and that's the page!! this one came from the scrounge-ntfs(8) man page, System Manager's Manual energy, dated April, 2004. ancient. vintage. still serving. 🦋 mwah, go rescue some files bestie 💖

📦 where this page comes from