Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixing readme #20

Merged
merged 1 commit into from
Nov 16, 2023
Merged

fixing readme #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 14 additions & 24 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,6 @@

The Rust NTFS Undelete Tool is a command-line utility for recovering deleted files from NTFS (New Technology File System) volumes. It leverages the power of Rust programming language to provide fast and reliable file recovery capabilities, minimizing the risk of further data loss during the process.

The tool is built on-top of [Sleuthkit](https://www.sleuthkit.org/) version [4.11.1](https://www.sleuthkit.org/sleuthkit/docs/api-docs/4.11.1/index.html).

## Features

- Efficient and speedy file recovery from NTFS volumes.
Expand All @@ -20,23 +18,9 @@ The tool is built on-top of [Sleuthkit](https://www.sleuthkit.org/) version [4.1
- Supports recovering nested data
- Has built in file system detection which prevent running the tool on non-NTFS volumes.

## Installation
*!TODO*

### Prerequisites

- Rust programming language must be installed on your system. If not, you can download it from the official Rust website: https://www.rust-lang.org/tools/install
- Configuring libtsk-dev:
- Installing libtsk-dev on Ubuntu:
```bash
sudo apt-get update
sudo apt-get install libtsk-dev
```
- Creating symbolic links for static libs
```bash
sudo ln -s /usr/local/lib/libtsk.a /usr/local/lib/liblibtsk.a
sudo ln -s /usr/local/lib/libtsk.so /usr/local/lib/liblibtsk.so
```


### Building from Source
Expand All @@ -48,30 +32,28 @@ The tool is built on-top of [Sleuthkit](https://www.sleuthkit.org/) version [4.1
cd ntfs-undelete
```

2. Build the project with docker/podman:
2. Build the project with cargo:

```bash
docker build -t ntfs-undelete-builder -f dockerfiles/Dockerfile.x86_64-unknown-linux-gnu .
docker run --rm -ti -v `pwd`:/app ntfs-undelete-builder
cargo build --release
```

3. The binary will be available in the `target/release/` directory. You can either add this directory to your `PATH` environment variable or copy the binary to your desired location.

### Download a prebuilt binary

TODO!
*TODO!*

### Usage

```bash
(sudo) ntfs-undelete --output-dir <output_directory> --image <image> [--dry-run]
```

- `image`:
- `-i`,`--image`:
- The path to the NTFS image from which you want to recover deleted files. The image can be obtained with [`dd`](https://www.geeksforgeeks.org/dd-command-linux/)
- The path to the `/dev/sdX` of the device from which you want to recover deleted files.
- `output_directory`: The directory where recovered files will be stored. It must already exist.
- `--dry-run`: Perform a dry run, simulating the recovery process without actually writing files to the output directory.
- `-o`,`--output-dir`: The directory where recovered files will be stored. It must already exist.
- `-d`,`--dry-run`: Perform a dry run, simulating the recovery process without actually writing files to the output directory.

## Examples

Expand All @@ -85,6 +67,14 @@ TODO!
```bash
ntfs-undelete --output-dir recovery_output --image ntfs_image.dd
```
3. Recover deleted files from the mounted NTFS volume:

```bash
# Usually automatically mounted by the OS
# sudo mount /dev/sda1 /media/mnt

ntfs-undelete --output-dir recovery_output --image /media/mnt
```
## Limitations

- The tool cannot recover files that have been overwritten since deletion.
Expand Down