ELF>?@@8 @@@@HH SS4+4+000 88800hhhDDStd88800Ptd@@@QtdRtd000/lib64/ld-linux-x86-64.so.2 GNUGNU<\I*vKw.+"zGNU>>em&W1Fx \T: DFt( 6L&, gd,X"_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable__libc_start_main__cxa_finalizentfs_attr_get_search_ctxntfs_attr_lookupntfs_attr_put_search_ctx__errno_locationntfs_log_redirectmallocAT_UNNAMEDntfs_attr_openntfs_attr_mst_preadntfs_attr_closentfs_log_clear_levelsntfs_ucstombsntfs_attr_preadntfs_mapping_pairs_decompressntfs_log_set_levelsntfs_attr_reinit_search_ctxntfs_calloclocaltimestrftime__stack_chk_failwrite__isoc23_strtollstrchr__snprintf_chkstrlenlstatsnprintfntfs_cluster_read__memset_chkutime__sprintf_chkftruncateregcompregexecregfreentfs_log_handler_outerrntfs_log_set_handleropterrgetopt_longntfs_log_get_levelsoptindoptoptoptargntfs_homentfs_log_parse_option__isoc23_strtol__isoc23_strtoulsetlocalentfs_check_if_mountedntfs_mountntfs_umountlibntfs-3g.so.89libc.so.6GLIBC_2.33GLIBC_2.4GLIBC_2.34GLIBC_2.3.4GLIBC_2.2.5GLIBC_2.38NXii cmti xui 0@8P@@y`~ @`ŠР֠۠ @`   %&ȿ)п9ؿ>< (0 8 @HPX`hpx Ⱦ!о"ؾ#$'(*+,-. /(00182@3H4P5X6`7h8p:x;=HHHtH5%ĝ@hfhfhfhfhfhfhfhrfhbfh Rfh Bfh 2fh "fh fhfhfhfhfhfhfhfhfhfhrfhbfhRfhBfh2fh"fhfhfhfh fh!fh"fh#fh$fh%fh&fh'rfh(bfh)Rfh*Bfh+2fh,"fh-fh.fh/fh0fh1f%~fD%fD%fD%~fD%vfD%nfD%ffD%^fD%VfD%NfD%FfD%>fD%6fD%.fD%&fD%fD%fD%fD%fD%fD%fD%fD%fD%ޙfD%֙fD%ΙfD%ƙfD%fD%fD%fD%fD%fD%fD%fD%fD%~fD%vfD%nfD%ffD%^fD%VfD%NfD%FfD%>fD%6fD%.fD%&fD%fD%fD%fD%fDUHAWAVAUATL%{S1HxH=HdH%(HE1GH1E1f=tfDnHDžiHbǛDžDž|HE1H HatvIcL>At!uD|A H=E  H= L aE11<H5-tH=}= H=w L aE1AD HyHHcHTH{S"w!H4HsHJH8L vAUE1RH5sH=C}1AZA[pE1ɀ=D ϙu|"LvE1HvL%sPL-|L1ARL )bLL57czE1LL PbL1YAXE1L=0LLH&cL GvA7AVP1"H Lv a E1H=HtHEdH+%(HeD[A\A]A^A_]ÿB={uo*=cS=sSL-gHIcEH|AWIcEE1HL tH5qH=M{t1XZ~H= 1H5_H=ߗHڔ1HL0M5L LLIHG8"9LMLHA;D<5 HxHcH>="=–HE1H1LH8HH@<%5<+H={HHHdH=_HL(MnLL<*uHuHc'H^D zDzAUHcH<0 * . ? IHݒE1LL8L5YM0L0LxLcHAHcMHzHIHHHLHhM9dDMML@ffnHfpIE1o1L VH5jdH=tze===w=E11lL XH5iH=ss=uH_mWE1PL=i1L-rsL [LL#E1LHL &mL0HYP1H EFHHHrH8,{0PL-rE1ARL Z1LL}A7E1AVL l1LLWH BA:L VE1XH5hH=^r1-H=ߎ1=$=%>L VE11]H5?hH=q~)E101L "UH5hH=q=u =3HL UE1SdAUE1AVL j?H5gH=q1AYAZ HHHcHDHrH L- HI9iA|$,HHY I$H1ɾHHL5dMH=LL1Lg+L# I$AL$5H@@HI9|LhLLLHAT$,HLHIHAD$,HH9H"A;D$,jIM9~LVLE1HL-0fE1L Qjq LH=ZpH)ȹHP1L<$E1LH=5pL -j1r ]_AX_HH+EAL$5I$LL beHCH=oH@@HH9HOº E1P15ZY8AVE1AUL ~[H5$eH=o1[A\AH=3f=-0f LF6QH5dE15H=n L c0^_A1GH5dL ZRE1H=DnP1Y^n 7AQE1H5>d1AUH=$nL ZEAZA[H= nH5dE1@1L sfrL PAVE1R@.pE1 1L bH5cH=mH= H= H=|H!ZVE1PL%5c1H'mL eLHE1H߹L ZL1_AXAWE1GAVL oOH5bH=ql1JXZSL )fVE1AV*Mk IMkMkMi1L)HDfD$HȈD0fUL PE1fE1AWAUL eE1 1L-aL :aALH=leE1LL L H=k1@1H; ߇HʇL<L9ZrtHHHBD8H9r=HLH'AƅuP L LE1SLH=qk1XZEHAEH]APL _E15D H5`H=:klAYAZ5E1< 1L dH5`H=j:H]ASE1PL Ic14H5`H=jL1[A\RE1I1L cH5P`dH=idE1ASQQL [cpE11L VL5cE1l 1L-_L bLH=jBAAQL-_E11AVg LL cH=iAZA[PE1AUH5__H=si1L cZYH=WiH53_HgHcH>L KQE1AV4E11L KH5^H=`hKVAUL ]^E11AVV H5^H=hHHA^A_L fbE1H H5^^H=hHxE1/1L RFH5(^H=gAVL )VE11AU {A_XPHT(E1PL `1OXZHYAUE1PL \`*1#A^A_|HcVASE1PL .`"1[A\OHVAPE1PL `$1AYAZ!_H'WQL _E1P&1^_E131L HH5\H=gfb[E1B 1L ?\H5\H=f4L IE1H5\H=ff.@1I^HHPTE11H=f.H=1H*H9tHHt H=H5H)HH?HHHtHHtfD=u+UH=rHt H=d]wHUHAVLwAUIATSH_L#L9u :IH{XHtH{pHtHLI$M9uI] Mu L#L9u6IH{HtgH{PHtYHLNI$M9uI}P<[LA\A]A^],@UHATSHtLA1HHtZP11E1jE11DZYu5LcHHeL[A\]DE1E1E11L >H5ZH=dcff.fUHAWAVAUATSHhH}H. HXIH H@It$ I$fHnHEHEflHuAD$fHnƋx,flAD$ ID$PH? HEH|1ɾHIH HEMD$PLp,HH-H0 L,It$PEPIt$P I>It$PH,HMH*!NbAEILHBzՔHHH?HH)IT$HcHt AD$LIt$P1HEH EI*!NbIBzՔEhC`}9}ochEfcXAd$0HS(HC ~EH9HLIT$@H9HLƒEID$@ID$I\$fHnflHH]11E1E110SjZYLCMA@xM4tHHI~BHxAv@pAFAC`AoN(AF8K INC0LHIHH?HH)INHS8LHIHH?HH)INHS@LHIHH?HH)IN HSHLHIHH?HH)1HSPHSXZ}HCpIHChHEȋp,HEH9HEHz1ɾHHEHHEHMIL#ChH}P,LLEHHHE@E1HTHPE1E11HE110jAXAY LUMZMH*!NbACIHBzՔIKHHH?HH)H;S8C`A8CALxMMAT10E1jE111~^_ID$HPHPA:S`:A:VALBAD$HfLEH1L r9 H5TAPH=_E1mAZA[H}H}GfEUH}It$P1HH+L5TiAWAGLIU`IE8H}1LFIU@~EIEPIE8H9HLIT$@H9HLID$@ID$(Ml$(fHnflAEL(S11E1jE11)ZYL{MhIH1A‰P$AG AM(AE,Aw @u8IA~G8IG(HWfHnIE0IG0flAE@A Au 1IULI}ex AU$L 8E1L1H=8^АH}`HeL[A\A]A^A_]fDMHELxLRHEp@1HSpHxBHCpfDL 7E1H5RH=n]@MLuLxLHE@LuI\$PLAVE1E1j111UA]A_tIFHgH)؍PX;SXK[9JHcDD3D43HuADE*E!BDr9xIHHuDEDp1HPXH|3D@`DHx IEXHt6HL QE1P^H5gQ1H=A\IEXAZA[H]ID$0HSE1E1j111:AXAYH{HH*!NbGHBzՔHLGG8IAE0LHJI?HL)LGIE8ILHJI?HL)LGIE@IHO LHJI?HL)IEHHHH H?HH)IEPH]1E1E111Sje^_uHCHtPo|(A} ID$~EMl$H}fHnflAEL(nMLL]]HEH_E11SL F4H5OH=ZFLL6XZE1@E1Y1L 3H5OH=ZLE11L _4H5UOH=Z^E11H5.OL z4H=#ZHuHrHuE11L 4H=ZlE11H5NL Z3H=YHu:H}HuE1}1L 3H=Y LH5oN_H5cNL %3E1H5FNH=YL A2E1RH5NH=&YLPE1H1L 1H5MH=X["fDUHAWAVAUATLeSHHH(dH%(HE1@HMLHI{HHC LC EA A!{LEAADL9..E11ACAE#DHP8Lx@HL9ILH9HLI9t:Hxuۃx$P(Dx,RҋPXAEEAEA9DL@HC0HLHHDHE1P1QATAQL 2ASWH=@WVH5LAR3HPHEdH+%(u(He[A\A]A^A_]D..E11xoff.@UE1L L$HAWIAVL5ELAULmATL%sUSHLHH@H}dH%(HE17L_ALHHLHLL /LLHEE1%H$1"I9LLHFL,$E1H޹'L1L KEWHAXAYEPHELxHpI9Huf@N>L ]NE1HLD1XDYqEtH=IcL]EdACXdHL]E1LUL 0&H5>PH=LI1LUAYA[L]IB(EzHIHEHL]E1H5Q>L %&0H=H1YL]^L]L J%E1E11L ?H5=H=HgE1AUHAUATSHdH%(HE1HEHub1DI1HuHIH.8"tyHUHt;-MiMiMiMiMeHUdH+%(He[A\A]]HL ?E1ScH5<H=E1BX1Z@HL %E1RyDE1h1L $H5p<H=E1WUHAVAUATSH dH%(HE1HI-HIfIH9tHuHBtiMuHEHHEA~uQHHEIEI$HUdH+%(uBH [A\A]A^]f.k1ːHuI~tHEHUUHAWAVAUATISHdH%(HE1HH=HDHIHRL{=VL1HsXZLL0LLHADžuTAA)HcMcLALH1EL=HLLfu A~HEdH+%(uaHe[A\A]A^A_]HL<V9HtHIL<RHH<L1D@UHAWAVAUATSHdH%(HE1HDIIHHHxPf=_AD$(HHhI-IH HCP@H9H`HCHPLH HC H{ HH9 H@HXHHHH5_HHSHXH=j_D{$EL{PMIHX|IIWH H0MWE1IHoHHHcH9yHpL8PfLHL-H|DLsD9IHpHH9HLWt5^uHh5^LH|DLD9sHHL :E1Z%f.H7L :E1H`HƺHBHPH1]E11H`HPL 9輾HNj]OQDL8IR IHPH0E1m1H`HPL 8:H 6]tY{Xdu*HS0Hs8H9|HAD$(H)H9 IH9E11H`HPL |y.E11H`HPL 9譽DHHHXH~@fl)NHHHCHQ0H^HXH`L HPPE1R1)H HH9@aHHALHHX4ADžE11H`HPL 7谼Hs`S8DQH;C8D蝽E11H`HPL 7\fDL(H0E1HEdH+%(HeD[A\A]A^A_]XE11H`RL aHPлXZfHHHp0HLL1LX6H 6!LPLHE11AUL aH53H=F>AXZ f.HHL 6E1`HPH`1|E1DHHL #6E1eE11H`HPL t蟺uf.E1G1H`HPL 5Lp`Hh1LHLpAD$(IBH1LpEILӋ|DLD9HhIAD$(HCL9EILpRH`E1HPL 豹@HH`E11R&HPL zHh5XLHIWAD$(AYAZHH1HpH)fHhIWHAD$(HH9|DLD9sHHL 54E1,E11H`L H=;豸6HLpE11RH`L EHP7wHh5WLHLpAD$(_AXIBH1LpMEILHp|DD9mHhIIAD$(HCL9EIMLpSE11H`HPL `賷E11H`HPL 腷Hp5HXHE1HHL p2 QH`HP18A[A\:E1HHL b2E1KHXHE1HHL 2QE1 1HPH`L 2HH讶D趷HHE1=LpL 1e|j}E11H`HPL 19OE1,ff.UHAWAVAUATSHHhdH%(HE1HHHQ1ɾHPHzHh HHHPH@@H@蘷HHyH5mTHt =iTH}҃蘶HhE1L wH5-H=8HI5Lh@1ILpE11L nH5w-H=7H@HE1IDž\H0IH@ LLHPL)H9HO苶HLL(MJH8HL E.LbL9pL`HxAHhLIHH$SH~I;F}iH=R3M~I^I9tNLHML0DIt$XHtE111LߵM$$I9uLHLHxAI9mHpII91H(\H L |E1H5+PH=616XZH=Rt H}衳H HhHPH`莴HEdH+%(\He[A\A]A^A_]LHHQHt I;F@HQHt I;F@HhLAËPQD9~ D kQDHLE=QDH QE\L`HH8HII9L(L I L9@Lb@s=PDHlI6HhDHDHE1 1L _-H5)DHH=?4ZDH fDD9 ARL E11ATH5)H=3A[[eE11L H5])LHH=3Ͱ(L E11E1乀H5%)H=3蜰D\\VE1H=e3A6L v H5(e_DHAX1ɉ\L E1H5(H=3"Dž\E11L H5s(H=2Dž\vHHCouldn't create a search context. ERROR: Couldn't allocate memory in read_record() ERROR: Couldn't open $MFT/$DATAERROR: Couldn't read MFT Record %lld. ERROR: Couldn't allocate memory in get_filenames(). ERROR: Couldn't allocate memory in get_parent_name() ERROR: Couldn't create a search context. ERROR: Couldn't get filenames. ERROR: Couldn't allocate memory in get_data(). ERROR: Cannot translate name into current locale. ERROR: Couldn't get data streams. %-8lld %c%c%c%c %3d%% %s %9lld %s Metadata may span more than one MFT record ________________________________________ Amount potentially recoverable %d%% File is encrypted, recovery is impossible. File is compressed, recovery not yet implemented. File is resident, therefore recoverable. File has no runlist, hence no data. File has an empty runlist, hence no data. Missing segment at beginning, %lld clusters Missing segment at end, %lld clusters ERROR: Unexpected error whilst calculating percentage for inode %lld Internal error, strtoll didn't return a suffix. Invalid size suffix '%s'. Use T, G, M, or K. Can't read info from mft record %lld. File has no recoverable data. File has no data. There is nothing to recover. Missing segment at beginning, %lld clusters. Missing segment at end, %lld clusters. Truncation not performed because file has an inconsistent $MFT record. ERROR: Couldn't set the file's date and time Undeleted '%s:%s' successfully to %s. Undeleted '%s' successfully to %s. ERROR: Couldn't open $MFT/$BITMAPERROR: Couldn't allocate memory in scan_disk() ERROR: Couldn't create a regex. Inode Flags %%age Date Time Size Filename ----------------------------------------------------------------------- Couldn't read MFT Record %lld. Couldn't compare filename with regexERROR: Failed to undelete inode %lli ! Files with potentially recoverable content: %d ERROR: Couldn't alloc mem for parsing inodes! ERROR: Missing new value at end of input! Pattern to transform is empty Couldn't allocate memory in transform() Invalid time suffix '%s'. Use Y, M, W, D or H. Option '%s' requires an argument. -b:Cc:d:fh?i:m:o:OPp:sS:t:TuqvVYou must specify exactly one device. Scan can only be used with --percent, --match, --ignore-case, --size and --time. The --case option doesn't make sense without the --match option Copy can only be used with --output and --destination. You can only select one of Scan, Undelete or Copy. Percentage value must be in the range 0 - 100. You may not use --quiet and --verbose at the same time. You may not use --quiet when scanning a volume. To use --parent, you must also use --verbose. %s v%s (libntfs-3g) - Recover deleted files from an NTFS Volume. Copyright (c) 2002-2005 Richard Russon Copyright (c) 2004-2005 Holger Ohmacht Copyright (c) 2005 Anton Altaparmakov Copyright (c) 2007 Yura Pakhuchiy Copyright (c) 2013-2018 Jean-Pierre Andre Developers' email address: ntfs-3g-devel@lists.sf.net This program is free software, released under the GNU General Public License and you are welcome to redistribute it under certain conditions. It comes with ABSOLUTELY NO WARRANTY; for details read the GNU General Public License to be found in the file "COPYING" distributed with this program, or online at: http://www.gnu.org/copyleft/gpl.html Usage: %s [options] device -s, --scan Scan for files (default) -p, --percentage NUM Minimum percentage recoverable -m, --match PATTERN Only work on files with matching names -C, --case Case sensitive matching -S, --size RANGE Match files of this size -t, --time SINCE Last referenced since this time -u, --undelete Undelete mode -i, --inodes RANGE Recover these inodes -o, --output FILE Save with this filename -O, --optimistic Undelete in-use clusters as well -d, --destination DIR Destination directory -b, --byte NUM Fill missing parts with this byte -T, --truncate Truncate 100%% recoverable file to exact size. -P, --parent Show parent directory -c, --copy RANGE Write a range of MFT records to a file -f, --force Use less caution -q, --quiet Less output -v, --verbose More output -V, --version Display version information -h, --help Display this help Failed to set locale, using default '%s'. Error getting information about %sFailed to determine whether %s is mountedUse the force option to ignore this error. Access is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command. You can use force option to avoid this check, but this is not recommended and may lead to data corruption. The device '%s' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around? NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE! The usage of the /f parameter is very IMPORTANT! No modification was made to NTFS by this software. The NTFS partition is hibernated. Please resume Windows and turned it off properly, so mounting could be done safely. Access is denied because the NTFS journal file is unclean. Choices are: A) Shutdown Windows properly. B) Click the 'Safely Remove Hardware' icon in the Windows taskbar notification area before disconnecting the device. C) Use 'Eject' from Windows Explorer to safely remove the device. D) If you ran chkdsk previously then boot Windows again which will automatically initialize the journal. E) Submit 'force' option (WARNING: This solution it not recommended). F) ntfsmount: Mount the volume read-only by using the 'ro' mount option. You seem to have a SoftRAID/FakeRAID hardware and must use an activated, different device under /dev/mapper, (e.g. /dev/mapper/nvidia_eahaabcc1) to mount NTFS. Please see the 'dmraid' documentation for help. Volume is scheduled for check. Please boot into Windows TWICE, or use the 'force' option. NOTE: If you had not scheduled check and last time accessed this volume using ntfsmount and shutdown system properly, then init scripts in your distribution are broken. Please report to your distribution developers (NOT to us!) that init scripts kill ntfsmount or mount.ntfs-fuse during shutdown instead of proper umount. WARNING: Dirty volume mount was forced by the 'force' mount option. ERROR: Failed to scan device '%s'. ERROR: NO inode(s) AND NO match-regex specified! Inode Flags %%age Date Size Filename Couldn't allocate memory in copy_mft() Couldn't create output file '%s'ERROR: Failed to read MFT blocks %lld-%lld. utils.cntfsundelete.cRecovered file name %s %F %RDirectoryFileMFT Record %lld Type: %s Date: %s Data Streams: Filename: (%d) %s File Flags: System Directory Sparse Reparse Compressed Encrypted Parent: %s Size alloc: %lld Size data: %lld Date C: %s Date A: %s Date M: %s Date R: %s Name: %s Resident Compressed Encrypted Size init: %lld Size vcn: %lld Data runs: None %lld @ %lld Creating file: %s Couldn't open $BitmapCouldn't read $BitmapFile has no data streams. File is %d%% recoverable Invalid size '%s'. unknown%s/%s:%s%s/%s.%dRecord is in use by the mft Forced to continue. %s%lldCouldn't create file %sFile has resident data. Write failedClose failedFile has a sparse section. Read failedTruncation failedmftUnknown option '%s'. ERROR: Invalid Number: %s ERROR: Missing range end! Invalid time '%s'. 2022.10.3ntfsundelete %s %s%s The device %s doesn't exist Failed to mount '%s'Range to copy is backwards. Couldn't open $MFT/$DATACouldn't read MFT Record %lldRead %lld MFT Records MFT extracted to file %s bytecasecopydestinationforcehelpinodesmatchoptimisticoutputparentpercentagequietscansizetimetruncateverboseversionhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh"s0$όއ݉mQƇ-------~----------z-----------------~----------zߙ............Y.....2utils_parse_sizeutils_cluster_in_usefind_first_attributedump_recordparse_inode_argtransformparse_timeversionusageparse_optionsutils_set_localeutils_valid_deviceutils_mount_volumehandle_undeletecopy_mftmainname_matchscan_diskset_dateundelete_fileopen_filelist_recordcalc_percentageverify_parentget_parent_namerescue_nameget_filenamesget_dataread_record.*\.;x| |@p`00d X x``0`@zRx &D$4x0FJ w?9*3$"\{t{ 0(JC BFFEBBA $ĘAC CK F ,L* AC M G ,LAC HEQ F 0HkAW BEIFH B 4|AC MP G P H ^ PaA` Al $@AC I A 8JC FJ C   $8,mAC I D (`tAC K K ,(\AC HK D ,Xt AC P I ,JAC P5 A ,x{"EC HH7 A @P@yb~CcdfhimOoPŠpРq֠s۠StTuvV=N s08o   PH oo oo\ o0 @ P ` p !! !0!@!P!`!p!!!!!!!!!"" "0"@"P"`"p"""""""""## #0#@#/usr/lib/debug/.dwz/x86_64-linux-gnu/ntfs-3g.debug$G[ow(؎~ ad3c1b5c492a764bca0477e62eb7832bc9227a.debugq.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink 880&hh$9 Go$Q Y ao\ \ ~no p}PPHB  0P#P#`#`# &&JMss @'@@L0088@@    G `4/