TestDisk NTFS undelete - filter by year
Posted: 02 May 2020, 18:58
Hi Christophe, last night I've sent you an email with the following content, maybe it's in your spam folder, please take a look.
I'm using your wonderful TestDisk to recover a lot of files deleted from an USB external NTFS disk.
I can recover the files by searching by name (using the 'f' shortcut), but as there are a lot of files and I don't need all of then I would like to be able to filter by date, or better yet by YEAR.
In TestDisk 7.0 I can check the file date by looking a the Date column (marked with red in the next image):
Now, to be able to filter by date I implemented a quick and dirty "Date filter" shortcut in ntfs_udl.c cloned from git:
I just need to recover files created on year 2020, so, if my fix is ok this should work.
The problem I have now is I can't check the file date, because the version I can compile is 7.2-WIP, and this version doesn't show the file date, please check the next screenshot:
The questions are:
1. With my fix, can I be sure all the files created in year 2020 will be filtered to be undeleted?
2. If not, could you help me show the file date column?, this way I could debug my fix.
Regards,
Leonardo M. Ramé
I'm using your wonderful TestDisk to recover a lot of files deleted from an USB external NTFS disk.
I can recover the files by searching by name (using the 'f' shortcut), but as there are a lot of files and I don't need all of then I would like to be able to filter by date, or better yet by YEAR.
In TestDisk 7.0 I can check the file date by looking a the Date column (marked with red in the next image):
Now, to be able to filter by date I implemented a quick and dirty "Date filter" shortcut in ntfs_udl.c cloned from git:
Code: Select all
case 'd':
{
const char *needle=ask_string_ncurses("Date filter ");
if(needle!=NULL && needle[0]!='\0')
{
td_list_for_each(file_walker,&dir_list->list)
{
file_info_t *file_info;
file_info=td_list_entry(file_walker, file_info_t, list);
struct tm *local = localtime(&file_info->td_mtime);
if((file_info->status&FILE_STATUS_DELETED)==0 &&
local->tm_year + 1900!=2020) // only filter files modified in year 2020.
file_info->status|=FILE_STATUS_DELETED;
}
pos_num=0;
current_file=ntfs_next_non_deleted(&dir_list->list, &dir_list->list);
}
}
break;
I just need to recover files created on year 2020, so, if my fix is ok this should work.
The problem I have now is I can't check the file date, because the version I can compile is 7.2-WIP, and this version doesn't show the file date, please check the next screenshot:
The questions are:
1. With my fix, can I be sure all the files created in year 2020 will be filtered to be undeleted?
2. If not, could you help me show the file date column?, this way I could debug my fix.
Regards,
Leonardo M. Ramé