NTFS undelete session highlights

ntfsundelete.sh

# List deleted files from the MFT, sort by date
sudo ntfsundelete /dev/sdb1 | sort -n -r -k4 | \

# Construct commands to undelete each INODE to ~${date}/${inode}-{filename}
awk '{print "sudo ntfsundelete -u /dev/sdb1 -i " $1 " -o \"/run/media/fdupanovic/WD/" $4 "/" $1 "-" $7 "\"";}' | \

# Truncate day from dates
sed -r "s/-[0-9]+//2" | \

# Split into files with 2048 commands each to avoid memory segmentation errors
split -l 2048