{
    "mode": "man",
    "parameter": "NTFSRECOVER",
    "section": "8",
    "url": "https://www.chedong.com/phpMan.php/man/NTFSRECOVER/8/json",
    "generated": "2026-05-30T08:17:59Z",
    "synopsis": "ntfsrecover [options] device",
    "sections": {
        "NAME": {
            "content": "ntfsrecover - Recover updates committed by Windows on an NTFS volume\n",
            "subsections": []
        },
        "SYNOPSIS": {
            "content": "ntfsrecover [options] device\n",
            "subsections": []
        },
        "DESCRIPTION": {
            "content": "ntfsrecover applies to the metadata the updates which were requested on Windows but could not\nbe completed because they were interrupted by some event such as a power failure, a  hardware\ncrash, a software crash or the device being unplugged.  Doing so, the file system is restored\nto a consistent state, however updates to user data may still be lost.\n\nUpdating the file system generally requires updating several records which should all be made\nfor the file system to be kept consistent. For instance, creating a new file requires reserv‐\ning an inode number (set a bit in a bit map), creating a file record (store the file name and\nfile  attributes),  and registering the file in a directory (locate the file from some path).\nWhen an unfortunate event occurs, and one of these updates could be done but not all of them,\nthe file system is left inconsistent.\n\nA group of updates which have all to be done to preserve consistency is called a transaction,\nand the end of updates within a transaction is called the commitment of the transaction.\n\nTo protect from unfortunate events, Windows first logs in a special file all the metadata up‐\ndate requests without applying any, until the commitment is known. If the event occurs before\nthe commitment, no update has been made and the file system is consistent. If the  event  oc‐\ncurs  after  the  update,  the log file can be analyzed later and the transactions which were\ncommitted can be executed again, thus restoring the integrity of the file system.\n\nntfsrecover similarly examines the log file and applies the updates within committed transac‐\ntions which could not be done by Windows.\n\nCurrently, ntfs-3g does not log updates, so ntfsrecover cannot be used to restore consistency\nafter an unfortunate event occurred while the file system was updated by Linux.\n\n",
            "subsections": []
        },
        "OPTIONS": {
            "content": "Below is a summary of all the options that ntfsrecover accepts. The normal usage is to use no\noption at all, as most of these options are oriented towards developers needs.\n\nNearly  all  options have two equivalent names.  The short name is preceded by - and the long\nname is preceded by --.  Any single letter options, that don't take an argument, can be  com‐\nbined into a single command, e.g.  -bv is equivalent to -b -v.  Long named options can be ab‐\nbreviated to any unique prefix of their name.\n",
            "subsections": [
                {
                    "name": "-b --backward",
                    "content": "Examine the actions described in the logfile backward from the latest one to the  ear‐\nliest  one  without  applying  any update. This may encompass records generated during\nseveral sessions, and when Windows is restarted, it often  does  not  restart  writing\nwhere  it  ended the previous session, so this leads to errors and bad sequencing when\nexamining the full log file.\n",
                    "flag": "-b",
                    "long": "--backward"
                },
                {
                    "name": "-c --clusters",
                    "content": "Restrict the output generated when using options -b -f -u -p to the actions  operating\non  a  cluster  within the given cluster range.  CLUSTER-RANGE is defined by the first\nand last cluster numbers separated by a hyphen, for instance 100-109 or 0x3e8-0x3ff. A\nsingle  number means restricting to a single cluster. The first four log blocks have a\nspecial role and they are always shown.\n",
                    "flag": "-c",
                    "long": "--clusters"
                },
                {
                    "name": "-f --forward",
                    "content": "Examine the actions described in the logfile forward from the first one  to  the  last\none  without  applying any update. As the log file is reused circularly, the first one\nis generally not the earliest. Moreover when Windows is restarted, it often  does  not\nrestart  writing  where  it ended the previous sessions, and this leads to errors when\nexamining a log file generated during several sessions.\n",
                    "flag": "-f",
                    "long": "--forward"
                },
                {
                    "name": "-h --help",
                    "content": "Show some help information.\n",
                    "flag": "-h",
                    "long": "--help"
                },
                {
                    "name": "-k --kill-fast-restart",
                    "content": "When Windows has been interrupted with fast restart mode activated,  part  of  pending\nchanges  are  kept  in the Windows cache and only the same Windows version can recover\nthem. This option can be used to apply the changes recorded in the log file  and  drop\nthe ones in the Windows cache.  This is dangerous and may cause loss of data.\n",
                    "flag": "-k",
                    "long": "--kill-fast-restart"
                },
                {
                    "name": "-n --no-action",
                    "content": "Do not apply any modification, useful when using the options -p, -s or -u.\n",
                    "flag": "-n",
                    "long": "--no-action"
                },
                {
                    "name": "-p --play",
                    "content": "Undo  COUNT transaction sets and redo a single one, a transaction set being all trans‐\nactions between two consecutive checkpoints. This is useful for replaying some  trans‐\naction in the past. As a few actions are not undoable, this is not always possible.\n",
                    "flag": "-p",
                    "long": "--play"
                },
                {
                    "name": "-r --range",
                    "content": "Examine  the  actions described in the logfile forward restricted to the requested log\nfile block range without applying any update. The first four log blocks have a special\nrole and they are always examined.\n",
                    "flag": "-r",
                    "long": "--range"
                },
                {
                    "name": "-s --sync",
                    "content": "Sync the file system by applying the committed actions which have not been synced pre‐\nviously. This is the default option, used when none of the options -n, -f, -r, -p  and\n-u are present.\n\nThe  option  -s can be repeated to request applying the committed actions mentioned in\nthe obsolete restart page. This is useful for testing the situations where the  latest\nrestart page cannot be read though it can actually be read.\n",
                    "flag": "-s",
                    "long": "--sync"
                },
                {
                    "name": "-t --transactions",
                    "content": "Display the transaction parameters when examining the log file with one of the options\n--forward, --backward or --range.\n",
                    "flag": "-t",
                    "long": "--transactions"
                },
                {
                    "name": "-u --undo",
                    "content": "Undo COUNT transaction sets, thus resetting the file system to some checkpoint in  the\npast, a transaction set being all transactions between two consecutive checkpoints. As\na few actions are not undoable, this is not always possible.\n",
                    "flag": "-u",
                    "long": "--undo"
                },
                {
                    "name": "-v --verbose",
                    "content": "Display more debug/warning/error messages. This option may be used  twice  to  display\neven more information.\n",
                    "flag": "-v",
                    "long": "--verbose"
                },
                {
                    "name": "-V --version",
                    "content": "Show the version number, copyright and license of ntfsrecover.\n",
                    "flag": "-V",
                    "long": "--version"
                }
            ]
        },
        "EXAMPLES": {
            "content": "Sync an NTFS volume on /dev/sda1.\n\nntfsrecover -s /dev/sda1\n\nDisplay all actions which updated a cluster in range 100 to 119 :\n\nntfsrecover --verbose --backward --clusters=100-119 /dev/sda1\n\n",
            "subsections": []
        },
        "BUGS": {
            "content": "If you find a bug please send an email describing the problem to the development team:\nntfs-3g-devel@lists.sf.net\n",
            "subsections": []
        },
        "AUTHORS": {
            "content": "ntfsrecover was written by Jean-Pierre Andre\n",
            "subsections": []
        },
        "AVAILABILITY": {
            "content": "ntfsrecover is part of the ntfs-3g package and is available from:\nhttps://github.com/tuxera/ntfs-3g/wiki/\n",
            "subsections": []
        },
        "SEE ALSO": {
            "content": "ntfs-3g(8), ntfsfix(8), ntfsprogs(8)\n\n\n\nntfs-3g 2021.8.22                          September 2015                             NTFSRECOVER(8)",
            "subsections": []
        }
    },
    "summary": "ntfsrecover - Recover updates committed by Windows on an NTFS volume",
    "flags": [
        {
            "flag": "-b",
            "long": "--backward",
            "arg": null,
            "description": "Examine the actions described in the logfile backward from the latest one to the ear‐ liest one without applying any update. This may encompass records generated during several sessions, and when Windows is restarted, it often does not restart writing where it ended the previous session, so this leads to errors and bad sequencing when examining the full log file."
        },
        {
            "flag": "-c",
            "long": "--clusters",
            "arg": null,
            "description": "Restrict the output generated when using options -b -f -u -p to the actions operating on a cluster within the given cluster range. CLUSTER-RANGE is defined by the first and last cluster numbers separated by a hyphen, for instance 100-109 or 0x3e8-0x3ff. A single number means restricting to a single cluster. The first four log blocks have a special role and they are always shown."
        },
        {
            "flag": "-f",
            "long": "--forward",
            "arg": null,
            "description": "Examine the actions described in the logfile forward from the first one to the last one without applying any update. As the log file is reused circularly, the first one is generally not the earliest. Moreover when Windows is restarted, it often does not restart writing where it ended the previous sessions, and this leads to errors when examining a log file generated during several sessions."
        },
        {
            "flag": "-h",
            "long": "--help",
            "arg": null,
            "description": "Show some help information."
        },
        {
            "flag": "-k",
            "long": "--kill-fast-restart",
            "arg": null,
            "description": "When Windows has been interrupted with fast restart mode activated, part of pending changes are kept in the Windows cache and only the same Windows version can recover them. This option can be used to apply the changes recorded in the log file and drop the ones in the Windows cache. This is dangerous and may cause loss of data."
        },
        {
            "flag": "-n",
            "long": "--no-action",
            "arg": null,
            "description": "Do not apply any modification, useful when using the options -p, -s or -u."
        },
        {
            "flag": "-p",
            "long": "--play",
            "arg": null,
            "description": "Undo COUNT transaction sets and redo a single one, a transaction set being all trans‐ actions between two consecutive checkpoints. This is useful for replaying some trans‐ action in the past. As a few actions are not undoable, this is not always possible."
        },
        {
            "flag": "-r",
            "long": "--range",
            "arg": null,
            "description": "Examine the actions described in the logfile forward restricted to the requested log file block range without applying any update. The first four log blocks have a special role and they are always examined."
        },
        {
            "flag": "-s",
            "long": "--sync",
            "arg": null,
            "description": "Sync the file system by applying the committed actions which have not been synced pre‐ viously. This is the default option, used when none of the options -n, -f, -r, -p and -u are present. The option -s can be repeated to request applying the committed actions mentioned in the obsolete restart page. This is useful for testing the situations where the latest restart page cannot be read though it can actually be read."
        },
        {
            "flag": "-t",
            "long": "--transactions",
            "arg": null,
            "description": "Display the transaction parameters when examining the log file with one of the options --forward, --backward or --range."
        },
        {
            "flag": "-u",
            "long": "--undo",
            "arg": null,
            "description": "Undo COUNT transaction sets, thus resetting the file system to some checkpoint in the past, a transaction set being all transactions between two consecutive checkpoints. As a few actions are not undoable, this is not always possible."
        },
        {
            "flag": "-v",
            "long": "--verbose",
            "arg": null,
            "description": "Display more debug/warning/error messages. This option may be used twice to display even more information."
        },
        {
            "flag": "-V",
            "long": "--version",
            "arg": null,
            "description": "Show the version number, copyright and license of ntfsrecover."
        }
    ],
    "examples": [
        "Sync an NTFS volume on /dev/sda1.",
        "ntfsrecover -s /dev/sda1",
        "Display all actions which updated a cluster in range 100 to 119 :",
        "ntfsrecover --verbose --backward --clusters=100-119 /dev/sda1"
    ],
    "see_also": [
        {
            "name": "ntfs-3g",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/ntfs-3g/8/json"
        },
        {
            "name": "ntfsfix",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/ntfsfix/8/json"
        },
        {
            "name": "ntfsprogs",
            "section": "8",
            "url": "https://www.chedong.com/phpMan.php/man/ntfsprogs/8/json"
        }
    ]
}