[Cialug] NTFS undelete

[L. V. Lammert]

On Wed, 22 Jun 2022, Scott Yates wrote:

> If you can mount the drive at a block level, I don't see what advantage
> there would be to "windows drivers".  The recovery software typically has
> to access the device at the block level either way.  Did your friend
> indicate what additional help that would provide?
>
Supposedly there a number of file system attributes that are not available
to non-MS NTFS tools that can obfuscates the components of a file that has
been deleted (and other proprietary cruft).

It makes sense in that testdisk only found a few hundred deleted filies,
.. whereas there should be many more actually part of the NTFS file
system on a normal workstation.

	Lee