/usr/sbin
NameSizeModeActions
aa-load396800755editdlrm
aa-remove-unknown32250755editdlrm
aa-status400000755editdlrm
aa-teardown1370755editdlrm
accessdb149040755editdlrm
acpid539200755editdlrm
add-shell10530755editdlrm
addgnupghome30750755editdlrm
addgroup551910755editdlrm
adduser551910755editdlrm
agetty609920755editdlrm
apparmor_parser16298480755editdlrm
apparmor_status400000755editdlrm
applygnupgdefaults22170755editdlrm
argdist-bpfcc368620755editdlrm
arpd269600755editdlrm
arptables2244240755editdlrm
arptables-nft2244240755editdlrm
arptables-nft-restore2244240755editdlrm
arptables-nft-save2244240755editdlrm
arptables-restore2244240755editdlrm
arptables-save2244240755editdlrm
badblocks351440755editdlrm
bashreadline-bpfcc23800755editdlrm
bashreadline.bt6980755editdlrm
bcache-super-show146480755editdlrm
bindsnoop-bpfcc163460755editdlrm
biolatency-bpfcc113650755editdlrm
biolatency-kp.bt6640755editdlrm
biolatency.bt6810755editdlrm
biolatpcts-bpfcc102480755editdlrm
biopattern-bpfcc39570755editdlrm
biosdecode278560755editdlrm
biosnoop-bpfcc108330755editdlrm
biosnoop.bt11480755editdlrm
biostacks.bt9150755editdlrm
biotop-bpfcc95670755editdlrm
bitesize-bpfcc11660755editdlrm
bitesize.bt5670755editdlrm
blkdeactivate163510755editdlrm
blkdiscard229120755editdlrm
blkid557200755editdlrm
blkzone352000755editdlrm
blockdev352000755editdlrm
bpflist-bpfcc26010755editdlrm
bpftool16220755editdlrm
bridge1110960755editdlrm
btrfsdist-bpfcc66270755editdlrm
btrfsslower-bpfcc99850755editdlrm
cachestat-bpfcc65310755editdlrm
cachetop-bpfcc93670755editdlrm
cache_check14305680755editdlrm
cache_dump14305680755editdlrm
cache_metadata_size14305680755editdlrm
cache_repair14305680755editdlrm
cache_restore14305680755editdlrm
cache_writeback14305680755editdlrm
capable-bpfcc84770755editdlrm
capable.bt19260755editdlrm
capsh584560755editdlrm
cfdisk970080755editdlrm
cgdisk1704800755editdlrm
chcpu311040755editdlrm
chgpasswd597200755editdlrm
chmem352000755editdlrm
chpasswd557360755editdlrm
chronyd3062320755editdlrm
chroot394320755editdlrm
cobjnew-bpfcc530755editdlrm
compactsnoop-bpfcc113690755editdlrm
cpgr496080755editdlrm
cppw496080755editdlrm
cpudist-bpfcc70130755editdlrm
cpuunclaimed-bpfcc149380755editdlrm
cpuwalk.bt4970755editdlrm
criticalstat-bpfcc86070755editdlrm
cron600800755editdlrm
cryptdisks_start15440755editdlrm
cryptdisks_stop8440755editdlrm
cryptsetup2313200755editdlrm
ctrlaltdel147200755editdlrm
dbslower-bpfcc73910755editdlrm
dbstat-bpfcc37900755editdlrm
dcb824480755editdlrm
dcsnoop-bpfcc41260755editdlrm
dcsnoop.bt12610755editdlrm
dcstat-bpfcc38590755editdlrm
deadlock-bpfcc209430755editdlrm
debugfs2312880755editdlrm
delgroup189770755editdlrm
deluser189770755editdlrm
depmod1743280755editdlrm
devlink1544800755editdlrm
dhcpcd4048880755editdlrm
dirtop-bpfcc85680755editdlrm
dmeventd515920755editdlrm
dmidecode1384960755editdlrm
dmsetup1751600755editdlrm
dmstats1751600755editdlrm
dosfsck802640755editdlrm
dosfslabel393040755editdlrm
dpkg-preconfigure43560755editdlrm
dpkg-reconfigure45360755editdlrm
drsnoop-bpfcc68890755editdlrm
dumpe2fs351360755editdlrm
e2freefrag187440755editdlrm
e2fsck3730800755editdlrm
e2image433280755editdlrm
e2label1132160755editdlrm
e2mmpstatus351360755editdlrm
e2scrub72940755editdlrm
e2scrub_all53940755editdlrm
e2undo228400755editdlrm
e4crypt311040755editdlrm
e4defrag351280755editdlrm
ebtables2244240755editdlrm
ebtables-nft2244240755editdlrm
ebtables-nft-restore2244240755editdlrm
ebtables-nft-save2244240755editdlrm
ebtables-restore2244240755editdlrm
ebtables-save2244240755editdlrm
ebtables-translate2244240755editdlrm
era_check14305680755editdlrm
era_dump14305680755editdlrm
era_invalidate14305680755editdlrm
era_restore14305680755editdlrm
ethtool6673200755editdlrm
execsnoop-bpfcc100590755editdlrm
execsnoop.bt9280755editdlrm
exitsnoop-bpfcc96460755editdlrm
ext4dist-bpfcc66830755editdlrm
ext4slower-bpfcc99480755editdlrm
faillock228480755editdlrm
fatlabel393040755editdlrm
fdisk1171680755editdlrm
filefrag187600755editdlrm
filegone-bpfcc57760755editdlrm
filelife-bpfcc65280755editdlrm
fileslower-bpfcc73720755editdlrm
filetop-bpfcc64990755editdlrm
findfs147200755editdlrm
fixparts598800755editdlrm
fsadm245800755editdlrm
fsck434400755editdlrm
fsck.btrfs11850755editdlrm
fsck.cramfs311680755editdlrm
fsck.ext23730800755editdlrm
fsck.ext33730800755editdlrm
fsck.ext43730800755editdlrm
fsck.fat802640755editdlrm
fsck.minix557120755editdlrm
fsck.msdos802640755editdlrm
fsck.vfat802640755editdlrm
fsck.xfs25660755editdlrm
fsfreeze147200755editdlrm
fstab-decode146480755editdlrm
fstrim433920755editdlrm
funccount-bpfcc129810755editdlrm
funcinterval-bpfcc55900755editdlrm
funclatency-bpfcc115490755editdlrm
funcslower-bpfcc106300755editdlrm
gdisk2032480755editdlrm
genl1234720755editdlrm
getcap146480755editdlrm
gethostlatency-bpfcc39140755editdlrm
gethostlatency.bt12220755editdlrm
getpcaps146480755editdlrm
getty609920755editdlrm
groupadd728400755editdlrm
groupdel644240755editdlrm
groupmems597440755editdlrm
groupmod727440755editdlrm
grpck597200755editdlrm
grpconv513680755editdlrm
grpunconv513680755editdlrm
grub-bios-setup9815520755editdlrm
grub-install12258240755editdlrm
grub-macbless9691280755editdlrm
grub-mkconfig88400755editdlrm
grub-mkdevicemap723840755editdlrm
grub-probe9775760755editdlrm
grub-reboot48410755editdlrm
grub-set-default35560755editdlrm
halt15013040755editdlrm
hardirqs-bpfcc70190755editdlrm
hdparm1427760755editdlrm
iconvconfig352960755editdlrm
init1008160755editdlrm
inject-bpfcc164450755editdlrm
insmod1743280755editdlrm
install-sgmlcatalog45510755editdlrm
installkernel26590755editdlrm
integritysetup686720755editdlrm
invoke-rc.d165170755editdlrm
ip7729200755editdlrm
ip6tables2244240755editdlrm
ip6tables-apply70520755editdlrm
ip6tables-legacy951760755editdlrm
ip6tables-legacy-restore951760755editdlrm
ip6tables-legacy-save951760755editdlrm
ip6tables-nft2244240755editdlrm
ip6tables-nft-restore2244240755editdlrm
ip6tables-nft-save2244240755editdlrm
ip6tables-restore2244240755editdlrm
ip6tables-restore-translate2244240755editdlrm
ip6tables-save2244240755editdlrm
ip6tables-translate2244240755editdlrm
iptables2244240755editdlrm
iptables-apply70520755editdlrm
iptables-legacy951760755editdlrm
iptables-legacy-restore951760755editdlrm
iptables-legacy-save951760755editdlrm
iptables-nft2244240755editdlrm
iptables-nft-restore2244240755editdlrm
iptables-nft-save2244240755editdlrm
iptables-restore2244240755editdlrm
iptables-restore-translate2244240755editdlrm
iptables-save2244240755editdlrm
iptables-translate2244240755editdlrm
irqbalance602720755editdlrm
irqbalance-ui393040755editdlrm
iscsi-iname187440755editdlrm
iscsiadm3793200755editdlrm
iscsid2934320755editdlrm
iscsistart2810800755editdlrm
iscsi_discovery52930755editdlrm
isosize147200755editdlrm
iucode-tool556400755editdlrm
iucode_tool556400755editdlrm
javacalls-bpfcc550755editdlrm
javaflow-bpfcc540755editdlrm
javagc-bpfcc520755editdlrm
javaobjnew-bpfcc560755editdlrm
javastat-bpfcc540755editdlrm
javathreads-bpfcc570755editdlrm
kbdrate187520755editdlrm
killall5268560755editdlrm
killsnoop-bpfcc45540755editdlrm
killsnoop.bt8730755editdlrm
klockstat-bpfcc133560755editdlrm
kpartx431760755editdlrm
kvmexit-bpfcc114610755editdlrm
ldattach270080755editdlrm
ldconfig3870755editdlrm
ldconfig.real10512800755editdlrm
llcstat-bpfcc45840755editdlrm
loads.bt11270755editdlrm
locale-gen43160755editdlrm
logrotate965040755editdlrm
logsave144960755editdlrm
losetup763040755editdlrm
lsmod1743280755editdlrm
luksformat34010755editdlrm
lvchange31567120755editdlrm
lvconvert31567120755editdlrm
lvcreate31567120755editdlrm
lvdisplay31567120755editdlrm
lvextend31567120755editdlrm
lvm31567120755editdlrm
lvmconfig31567120755editdlrm
lvmdiskscan31567120755editdlrm
lvmdump103640755editdlrm
lvmpolld2416320755editdlrm
lvmsadc31567120755editdlrm
lvmsar31567120755editdlrm
lvreduce31567120755editdlrm
lvremove31567120755editdlrm
lvrename31567120755editdlrm
lvresize31567120755editdlrm
lvs31567120755editdlrm
lvscan31567120755editdlrm
lxc5890755editdlrm
lxd5890755editdlrm
make-bcache229120755editdlrm
mdadm6371440755editdlrm
mdflush-bpfcc22950755editdlrm
mdflush.bt7750755editdlrm
mdmon2650160755editdlrm
memleak-bpfcc212980755editdlrm
mkdosfs520480755editdlrm
mke2fs1337520755editdlrm
mkfs147200755editdlrm
mkfs.bfs229120755editdlrm
mkfs.btrfs5737520755editdlrm
mkfs.cramfs351440755editdlrm
mkfs.ext21337520755editdlrm
mkfs.ext31337520755editdlrm
mkfs.ext41337520755editdlrm
mkfs.fat520480755editdlrm
mkfs.minix434080755editdlrm
mkfs.msdos520480755editdlrm
mkfs.ntfs679760755editdlrm
mkfs.vfat520480755editdlrm
mkfs.xfs4495280755editdlrm
mkhomedir_helper228720755editdlrm
mkinitramfs157620755editdlrm
mklost+found146480755editdlrm
mkntfs679760755editdlrm
mkswap515920755editdlrm
ModemManager21655760755editdlrm
modinfo1743280755editdlrm
modprobe1743280755editdlrm
mount.fuse187360755editdlrm
mount.fuse3187360755editdlrm
mount.lowntfs-3g1218320755editdlrm
mount.ntfs1628240755editdlrm
mount.ntfs-3g1628240755editdlrm
mountsnoop-bpfcc149680755editdlrm
mpathpersist319600755editdlrm
multipath351280755editdlrm
multipathc187440755editdlrm
multipathd1458800755editdlrm
mysqld554679440755editdlrm
mysqld_qslower-bpfcc31250755editdlrm
naptime.bt10350755editdlrm
needrestart410920755editdlrm
netplan8020755editdlrm
netqtop-bpfcc57250755editdlrm
newusers890480755editdlrm
nfnl_osf187360755editdlrm
nfsdist-bpfcc50680755editdlrm
nfsslower-bpfcc139390755editdlrm
nft268560755editdlrm
nginx13141680755editdlrm
nodegc-bpfcc520755editdlrm
nodestat-bpfcc540755editdlrm
nologin146400755editdlrm
ntfsclone515920755editdlrm
ntfscp311040755editdlrm
ntfslabel229120755editdlrm
ntfsresize638880755editdlrm
ntfsundelete515920755editdlrm
offcputime-bpfcc137790755editdlrm
offwaketime-bpfcc156760755editdlrm
on_ac_power37880755editdlrm
oomkill-bpfcc20840755editdlrm
oomkill.bt11980755editdlrm
opensnoop-bpfcc145810755editdlrm
opensnoop.bt9530755editdlrm
overlayroot-chroot25100755editdlrm
ownership147920755editdlrm
pam-auth-update214650755editdlrm
pam_extrausers_chkpwd269442755editdlrm
pam_extrausers_update351360755editdlrm
pam_getenv28900755editdlrm
pam_namespace_helper4670755editdlrm
pam_timestamp_check146560755editdlrm
parted966640755editdlrm
partprobe147200755editdlrm
pdata_tools14305680755editdlrm
perlcalls-bpfcc550755editdlrm
perlflow-bpfcc540755editdlrm
perlstat-bpfcc540755editdlrm
php-fpm7.448033760755editdlrm
phpcalls-bpfcc540755editdlrm
phpdismod72780755editdlrm
phpenmod72780755editdlrm
phpflow-bpfcc530755editdlrm
phpquery63890755editdlrm
phpstat-bpfcc530755editdlrm
pidpersec-bpfcc11110755editdlrm
pidpersec.bt6280755editdlrm
pivot_root147200755editdlrm
plymouthd1500880755editdlrm
poweroff15013040755editdlrm
ppchcalls-bpfcc142240755editdlrm
profile-bpfcc147560755editdlrm
pvchange31567120755editdlrm
pvck31567120755editdlrm
pvcreate31567120755editdlrm
pvdisplay31567120755editdlrm
pvmove31567120755editdlrm
pvremove31567120755editdlrm
pvresize31567120755editdlrm
pvs31567120755editdlrm
pvscan31567120755editdlrm
pwck555920755editdlrm
pwconv472720755editdlrm
pwhistory_helper228480755editdlrm
pwunconv472720755editdlrm
pythoncalls-bpfcc570755editdlrm
pythonflow-bpfcc560755editdlrm
pythongc-bpfcc540755editdlrm
pythonstat-bpfcc560755editdlrm
rdmaucma-bpfcc50730755editdlrm
readahead-bpfcc66940755editdlrm
readprofile229440755editdlrm
reboot15013040755editdlrm
remove-shell11110755editdlrm
reset-trace-bpfcc34980755editdlrm
resize2fs719920755editdlrm
resolvconf1624800755editdlrm
rmmod1743280755editdlrm
rmt560240755editdlrm
rmt-tar560240755editdlrm
rsyslogd7901920755editdlrm
rtacct289920755editdlrm
rtcwake352000755editdlrm
rtmon1193120755editdlrm
rubycalls-bpfcc550755editdlrm
rubyflow-bpfcc540755editdlrm
rubygc-bpfcc520755editdlrm
rubyobjnew-bpfcc560755editdlrm
rubystat-bpfcc540755editdlrm
runlevel15013040755editdlrm
runqlat-bpfcc95260755editdlrm
runqlat.bt7880755editdlrm
runqlen-bpfcc82480755editdlrm
runqlen.bt10370755editdlrm
runqslower-bpfcc92250755editdlrm
runuser556800755editdlrm
service91040755editdlrm
setcap146480755editdlrm
setuids.bt17990755editdlrm
setvesablank147120755editdlrm
setvtrgb147760755editdlrm
sfdisk1089280755editdlrm
sgdisk1827680755editdlrm
shadowconfig22730755editdlrm
shmsnoop-bpfcc79850755editdlrm
shutdown15013040755editdlrm
slabratetop-bpfcc65370755editdlrm
sofdsnoop-bpfcc82550755editdlrm
softirqs-bpfcc57230755editdlrm
solisten-bpfcc61030755editdlrm
sshd9214160755editdlrm
ssllatency.bt21330755editdlrm
sslsniff-bpfcc140130755editdlrm
sslsnoop.bt20410755editdlrm
stackcount-bpfcc166550755editdlrm
start-stop-daemon486320755editdlrm
statsnoop-bpfcc50410755editdlrm
statsnoop.bt12940755editdlrm
sudo_logsrvd2544640755editdlrm
sudo_sendlog1348320755editdlrm
sulogin433920755editdlrm
swapin.bt6000755editdlrm
swaplabel188160755editdlrm
swapoff229120755editdlrm
swapon433920755editdlrm
switch_root229120755editdlrm
syncsnoop-bpfcc13000755editdlrm
syncsnoop.bt8390755editdlrm
syscount-bpfcc87710755editdlrm
syscount.bt8720755editdlrm
sysctl311120755editdlrm
tarcat9360755editdlrm
tc6452000755editdlrm
tclcalls-bpfcc540755editdlrm
tclflow-bpfcc530755editdlrm
tclobjnew-bpfcc550755editdlrm
tclstat-bpfcc530755editdlrm
tcpaccept-bpfcc92200755editdlrm
tcpaccept.bt17560755editdlrm
tcpcong-bpfcc205910755editdlrm
tcpconnect-bpfcc189020755editdlrm
tcpconnect.bt16150755editdlrm
tcpconnlat-bpfcc92850755editdlrm
tcpdrop-bpfcc76160755editdlrm
tcpdrop.bt24690755editdlrm
tcplife-bpfcc169490755editdlrm
tcplife.bt27850755editdlrm
tcpretrans-bpfcc140980755editdlrm
tcpretrans.bt21200755editdlrm
tcprtt-bpfcc89130755editdlrm
tcpstates-bpfcc140640755editdlrm
tcpsubnet-bpfcc78140755editdlrm
tcpsynbl-bpfcc21750755editdlrm
tcpsynbl.bt9620755editdlrm
tcptop-bpfcc129430755editdlrm
tcptracer-bpfcc181300755editdlrm
telinit15013040755editdlrm
thin_check14305680755editdlrm
thin_delta14305680755editdlrm
thin_dump14305680755editdlrm
thin_ls14305680755editdlrm
thin_metadata_size14305680755editdlrm
thin_repair14305680755editdlrm
thin_restore14305680755editdlrm
thin_rmap14305680755editdlrm
thin_trim14305680755editdlrm
threadsnoop-bpfcc18580755editdlrm
threadsnoop.bt7120755editdlrm
tipc926880755editdlrm
tplist-bpfcc41570755editdlrm
trace-bpfcc438920755editdlrm
ttysnoop-bpfcc76940755editdlrm
tune2fs1132160755editdlrm
ucalls119700755editdlrm
uflow81150755editdlrm
ufw49590755editdlrm
ugc78230755editdlrm
umount.udisks2146400755editdlrm
undump.bt7890755editdlrm
unix_chkpwd310402755editdlrm
unix_update351360755editdlrm
uobjnew61810755editdlrm
update-ca-certificates54460755editdlrm
update-catalog93930755editdlrm
update-grub640755editdlrm
update-grub-gfxpayload3010755editdlrm
update-grub2640755editdlrm
update-ieee-data34920755editdlrm
update-info-dir17000755editdlrm
update-initramfs69080755editdlrm
update-locale30570755editdlrm
update-passwd353920755editdlrm
update-pciids17780755editdlrm
update-rc.d181470755editdlrm
update-secureboot-policy76050755editdlrm
update-shells39840755editdlrm
update-xmlcatalog172840755editdlrm
upgrade-from-grub-legacy15960755editdlrm
usb_modeswitch610960755editdlrm
usb_modeswitch_dispatcher274180755editdlrm
useradd1432320755editdlrm
userdel931920755editdlrm
usermod1307120755editdlrm
ustat124120755editdlrm
uthreads41000755editdlrm
uuidd316240755editdlrm
validlocale17730755editdlrm
vcstime146400755editdlrm
vdpa353920755editdlrm
veritysetup449920755editdlrm
vfscount-bpfcc13900755editdlrm
vfscount.bt5150755editdlrm
vfsstat-bpfcc41590755editdlrm
vfsstat.bt7210755editdlrm
vgcfgbackup31567120755editdlrm
vgcfgrestore31567120755editdlrm
vgchange31567120755editdlrm
vgck31567120755editdlrm
vgconvert31567120755editdlrm
vgcreate31567120755editdlrm
vgdisplay31567120755editdlrm
vgexport31567120755editdlrm
vgextend31567120755editdlrm
vgimport31567120755editdlrm
vgimportclone31567120755editdlrm
vgmerge31567120755editdlrm
vgmknodes31567120755editdlrm
vgreduce31567120755editdlrm
vgremove31567120755editdlrm
vgrename31567120755editdlrm
vgs31567120755editdlrm
vgscan31567120755editdlrm
vgsplit31567120755editdlrm
vigr621440755editdlrm
vipw621440755editdlrm
virtiostat-bpfcc89000755editdlrm
visudo2587760755editdlrm
vpddecode149280755editdlrm
wakeuptime-bpfcc82910755editdlrm
wipefs392960755editdlrm
writeback.bt16990755editdlrm
xfsdist-bpfcc47230755editdlrm
xfsdist.bt9720755editdlrm
xfsslower-bpfcc79640755editdlrm
xfs_admin21740755editdlrm
xfs_bmap6950755editdlrm
xfs_copy926080755editdlrm
xfs_db7050880755editdlrm
xfs_estimate145040755editdlrm
xfs_freeze8000755editdlrm
xfs_fsr431920755editdlrm
xfs_growfs391520755editdlrm
xfs_info12940755editdlrm
xfs_io2085360755editdlrm
xfs_logprint801440755editdlrm
xfs_mdrestore350480755editdlrm
xfs_metadump8160755editdlrm
xfs_mkfile10400755editdlrm
xfs_ncheck6850755editdlrm
xfs_quota923280755editdlrm
xfs_repair6587600755editdlrm
xfs_rtcp185840755editdlrm
xfs_scrub1088160755editdlrm
xfs_scrub_all78410755editdlrm
xfs_spaceman433200755editdlrm
xtables-legacy-multi951760755editdlrm
xtables-monitor2244240755editdlrm
xtables-nft-multi2244240755editdlrm
zerofree144880755editdlrm
zfsdist-bpfcc54270755editdlrm
zfsslower-bpfcc86570755editdlrm
zic679840755editdlrm
zramctl558240755editdlrm
Edit: /usr/sbin/ntfsundelete (51592B)
ELF>?@@8 @@@@HH SS4+4+000 88800hhhDDStd88800Ptd@@@QtdRtd000/lib64/ld-linux-x86-64.so.2 GNUGNU<\I*vKw.+"zGNU>>em&W1Fx \T: DFt( 6L&, gd,X"_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable__libc_start_main__cxa_finalizentfs_attr_get_search_ctxntfs_attr_lookupntfs_attr_put_search_ctx__errno_locationntfs_log_redirectmallocAT_UNNAMEDntfs_attr_openntfs_attr_mst_preadntfs_attr_closentfs_log_clear_levelsntfs_ucstombsntfs_attr_preadntfs_mapping_pairs_decompressntfs_log_set_levelsntfs_attr_reinit_search_ctxntfs_calloclocaltimestrftime__stack_chk_failwrite__isoc23_strtollstrchr__snprintf_chkstrlenlstatsnprintfntfs_cluster_read__memset_chkutime__sprintf_chkftruncateregcompregexecregfreentfs_log_handler_outerrntfs_log_set_handleropterrgetopt_longntfs_log_get_levelsoptindoptoptoptargntfs_homentfs_log_parse_option__isoc23_strtol__isoc23_strtoulsetlocalentfs_check_if_mountedntfs_mountntfs_umountlibntfs-3g.so.89libc.so.6GLIBC_2.33GLIBC_2.4GLIBC_2.34GLIBC_2.3.4GLIBC_2.2.5GLIBC_2.38NXii cmti xui 0@8P@@y`~ @`ŠР֠۠ @`   %&ȿ)п9ؿ>< (0 8 @HPX`hpx Ⱦ!о"ؾ#$'(*+,-. /(00182@3H4P5X6`7h8p:x;=HHHtH5%ĝ@hfhfhfhfhfhfhfhrfhbfh Rfh Bfh 2fh "fh fhfhfhfhfhfhfhfhfhfhrfhbfhRfhBfh2fh"fhfhfhfh fh!fh"fh#fh$fh%fh&fh'rfh(bfh)Rfh*Bfh+2fh,"fh-fh.fh/fh0fh1f%~fD%fD%fD%~fD%vfD%nfD%ffD%^fD%VfD%NfD%FfD%>fD%6fD%.fD%&fD%fD%fD%fD%fD%fD%fD%fD%fD%ޙfD%֙fD%ΙfD%ƙfD%fD%fD%fD%fD%fD%fD%fD%fD%~fD%vfD%nfD%ffD%^fD%VfD%NfD%FfD%>fD%6fD%.fD%&fD%fD%fD%fD%fDUHAWAVAUATL%{S1HxH=HdH%(HE1GH1E1f=tfDnHDžiHbǛDžDž|HE1H HatvIcL>At!uD|A H=E  H= L aE11<H5-tH=}= H=w L aE1AD HyHHcHTH{S"w!H4HsHJH8L vAUE1RH5sH=C}1AZA[pE1ɀ=D ϙu|"LvE1HvL%sPL-|L1ARL )bLL57czE1LL PbL1YAXE1L=0LLH&cL GvA7AVP1"H Lv a E1H=HtHEdH+%(HeD[A\A]A^A_]ÿB={uo*=cS=sSL-gHIcEH|AWIcEE1HL tH5qH=M{t1XZ~H= 1H5_H=ߗHڔ1HL0M5L LLIHG8"9LMLHA;D<5 HxHcH>="=–HE1H1LH8HH@<%5<+H={HHHdH=_HL(MnLL<*uHuHc'H^D zDzAUHcH<0 * . ? IHݒE1LL8L5YM0L0LxLcHAHcMHzHIHHHLHhM9dDMML@ffnHfpIE1o1L VH5jdH=tze===w=E11lL XH5iH=ss=uH_mWE1PL=i1L-rsL [LL#E1LHL &mL0HYP1H EFHHHrH8,{0PL-rE1ARL Z1LL}A7E1AVL l1LLWH BA:L VE1XH5hH=^r1-H=ߎ1=$=%>L VE11]H5?hH=q~)E101L "UH5hH=q=u =3HL UE1SdAUE1AVL j?H5gH=q1AYAZ HHHcHDHrH L- HI9iA|$,HHY I$H1ɾHHL5dMH=LL1Lg+L# I$AL$5H@@HI9|LhLLLHAT$,HLHIHAD$,HH9H"A;D$,jIM9~LVLE1HL-0fE1L Qjq LH=ZpH)ȹHP1L<$E1LH=5pL -j1r ]_AX_HH+EAL$5I$LL beHCH=oH@@HH9HOº E1P15ZY8AVE1AUL ~[H5$eH=o1[A\AH=3f=-0f LF6QH5dE15H=n L c0^_A1GH5dL ZRE1H=DnP1Y^n 7AQE1H5>d1AUH=$nL ZEAZA[H= nH5dE1@1L sfrL PAVE1R@.pE1 1L bH5cH=mH= H= H=|H!ZVE1PL%5c1H'mL eLHE1H߹L ZL1_AXAWE1GAVL oOH5bH=ql1JXZSL )fVE1AV*Mk IMkMkMi1L)HDfD$HȈD0fUL PE1fE1AWAUL eE1 1L-aL :aALH=leE1LL L H=k1@1H; ߇HʇL<L9ZrtHHHBD8H9r=HLH'AƅuP L LE1SLH=qk1XZEHAEH]APL _E15D H5`H=:klAYAZ5E1< 1L dH5`H=j:H]ASE1PL Ic14H5`H=jL1[A\RE1I1L cH5P`dH=idE1ASQQL [cpE11L VL5cE1l 1L-_L bLH=jBAAQL-_E11AVg LL cH=iAZA[PE1AUH5__H=si1L cZYH=WiH53_HgHcH>L KQE1AV4E11L KH5^H=`hKVAUL ]^E11AVV H5^H=hHHA^A_L fbE1H H5^^H=hHxE1/1L RFH5(^H=gAVL )VE11AU {A_XPHT(E1PL `1OXZHYAUE1PL \`*1#A^A_|HcVASE1PL .`"1[A\OHVAPE1PL `$1AYAZ!_H'WQL _E1P&1^_E131L HH5\H=gfb[E1B 1L ?\H5\H=f4L IE1H5\H=ff.@1I^HHPTE11H=f.H=1H*H9tHHt H=H5H)HH?HHHtHHtfD=u+UH=rHt H=d]wHUHAVLwAUIATSH_L#L9u :IH{XHtH{pHtHLI$M9uI] Mu L#L9u6IH{HtgH{PHtYHLNI$M9uI}P<[LA\A]A^],@UHATSHtLA1HHtZP11E1jE11DZYu5LcHHeL[A\]DE1E1E11L >H5ZH=dcff.fUHAWAVAUATSHhH}H. HXIH H@It$ I$fHnHEHEflHuAD$fHnƋx,flAD$ ID$PH? HEH|1ɾHIH HEMD$PLp,HH-H0 L,It$PEPIt$P I>It$PH,HMH*!NbAEILHBzՔHHH?HH)IT$HcHt AD$LIt$P1HEH EI*!NbIBzՔEhC`}9}ochEfcXAd$0HS(HC ~EH9HLIT$@H9HLƒEID$@ID$I\$fHnflHH]11E1E110SjZYLCMA@xM4tHHI~BHxAv@pAFAC`AoN(AF8K INC0LHIHH?HH)INHS8LHIHH?HH)INHS@LHIHH?HH)IN HSHLHIHH?HH)1HSPHSXZ}HCpIHChHEȋp,HEH9HEHz1ɾHHEHHEHMIL#ChH}P,LLEHHHE@E1HTHPE1E11HE110jAXAY LUMZMH*!NbACIHBzՔIKHHH?HH)H;S8C`A8CALxMMAT10E1jE111~^_ID$HPHPA:S`:A:VALBAD$HfLEH1L r9 H5TAPH=_E1mAZA[H}H}GfEUH}It$P1HH+L5TiAWAGLIU`IE8H}1LFIU@~EIEPIE8H9HLIT$@H9HLID$@ID$(Ml$(fHnflAEL(S11E1jE11)ZYL{MhIH1A‰P$AG AM(AE,Aw @u8IA~G8IG(HWfHnIE0IG0flAE@A Au 1IULI}ex AU$L 8E1L1H=8^АH}`HeL[A\A]A^A_]fDMHELxLRHEp@1HSpHxBHCpfDL 7E1H5RH=n]@MLuLxLHE@LuI\$PLAVE1E1j111UA]A_tIFHgH)؍PX;SXK[9JHcDD3D43HuADE*E!BDr9xIHHuDEDp1HPXH|3D@`DHx IEXHt6HL QE1P^H5gQ1H=A\IEXAZA[H]ID$0HSE1E1j111:AXAYH{HH*!NbGHBzՔHLGG8IAE0LHJI?HL)LGIE8ILHJI?HL)LGIE@IHO LHJI?HL)IEHHHH H?HH)IEPH]1E1E111Sje^_uHCHtPo|(A} ID$~EMl$H}fHnflAEL(nMLL]]HEH_E11SL F4H5OH=ZFLL6XZE1@E1Y1L 3H5OH=ZLE11L _4H5UOH=Z^E11H5.OL z4H=#ZHuHrHuE11L 4H=ZlE11H5NL Z3H=YHu:H}HuE1}1L 3H=Y LH5oN_H5cNL %3E1H5FNH=YL A2E1RH5NH=&YLPE1H1L 1H5MH=X["fDUHAWAVAUATLeSHHH(dH%(HE1@HMLHI{HHC LC EA A!{LEAADL9..E11ACAE#DHP8Lx@HL9ILH9HLI9t:Hxuۃx$P(Dx,RҋPXAEEAEA9DL@HC0HLHHDHE1P1QATAQL 2ASWH=@WVH5LAR3HPHEdH+%(u(He[A\A]A^A_]D..E11xoff.@UE1L L$HAWIAVL5ELAULmATL%sUSHLHH@H}dH%(HE17L_ALHHLHLL /LLHEE1%H$1"I9LLHFL,$E1H޹'L1L KEWHAXAYEPHELxHpI9Huf@N>L ]NE1HLD1XDYqEtH=IcL]EdACXdHL]E1LUL 0&H5>PH=LI1LUAYA[L]IB(EzHIHEHL]E1H5Q>L %&0H=H1YL]^L]L J%E1E11L ?H5=H=HgE1AUHAUATSHdH%(HE1HEHub1DI1HuHIH.8"tyHUHt;-MiMiMiMiMeHUdH+%(He[A\A]]HL ?E1ScH5<H=E1BX1Z@HL %E1RyDE1h1L $H5p<H=E1WUHAVAUATSH dH%(HE1HI-HIfIH9tHuHBtiMuHEHHEA~uQHHEIEI$HUdH+%(uBH [A\A]A^]f.k1ːHuI~tHEHUUHAWAVAUATISHdH%(HE1HH=HDHIHRL{=VL1HsXZLL0LLHADžuTAA)HcMcLALH1EL=HLLfu A~HEdH+%(uaHe[A\A]A^A_]HL<V9HtHIL<RHH<L1D@UHAWAVAUATSHdH%(HE1HDIIHHHxPf=_AD$(HHhI-IH HCP@H9H`HCHPLH HC H{ HH9 H@HXHHHH5_HHSHXH=j_D{$EL{PMIHX|IIWH H0MWE1IHoHHHcH9yHpL8PfLHL-H|DLsD9IHpHH9HLWt5^uHh5^LH|DLD9sHHL :E1Z%f.H7L :E1H`HƺHBHPH1]E11H`HPL 9輾HNj]OQDL8IR IHPH0E1m1H`HPL 8:H 6]tY{Xdu*HS0Hs8H9|HAD$(H)H9 IH9E11H`HPL |y.E11H`HPL 9譽DHHHXH~@fl)NHHHCHQ0H^HXH`L HPPE1R1)H HH9@aHHALHHX4ADžE11H`HPL 7谼Hs`S8DQH;C8D蝽E11H`HPL 7\fDL(H0E1HEdH+%(HeD[A\A]A^A_]XE11H`RL aHPлXZfHHHp0HLL1LX6H 6!LPLHE11AUL aH53H=F>AXZ f.HHL 6E1`HPH`1|E1DHHL #6E1eE11H`HPL t蟺uf.E1G1H`HPL 5Lp`Hh1LHLpAD$(IBH1LpEILӋ|DLD9HhIAD$(HCL9EILpRH`E1HPL 豹@HH`E11R&HPL zHh5XLHIWAD$(AYAZHH1HpH)fHhIWHAD$(HH9|DLD9sHHL 54E1,E11H`L H=;豸6HLpE11RH`L EHP7wHh5WLHLpAD$(_AXIBH1LpMEILHp|DD9mHhIIAD$(HCL9EIMLpSE11H`HPL `賷E11H`HPL 腷Hp5HXHE1HHL p2 QH`HP18A[A\:E1HHL b2E1KHXHE1HHL 2QE1 1HPH`L 2HH讶D趷HHE1=LpL 1e|j}E11H`HPL 19OE1,ff.UHAWAVAUATSHHhdH%(HE1HHHQ1ɾHPHzHh HHHPH@@H@蘷HHyH5mTHt =iTH}҃蘶HhE1L wH5-H=8HI5Lh@1ILpE11L nH5w-H=7H@HE1IDž\H0IH@ LLHPL)H9HO苶HLL(MJH8HL E.LbL9pL`HxAHhLIHH$SH~I;F}iH=R3M~I^I9tNLHML0DIt$XHtE111LߵM$$I9uLHLHxAI9mHpII91H(\H L |E1H5+PH=616XZH=Rt H}衳H HhHPH`莴HEdH+%(\He[A\A]A^A_]LHHQHt I;F@HQHt I;F@HhLAËPQD9~ D kQDHLE=QDH QE\L`HH8HII9L(L I L9@Lb@s=PDHlI6HhDHDHE1 1L _-H5)DHH=?4ZDH fDD9 ARL E11ATH5)H=3A[[eE11L H5])LHH=3Ͱ(L E11E1乀H5%)H=3蜰D\\VE1H=e3A6L v H5(e_DHAX1ɉ\L E1H5(H=3"Dž\E11L H5s(H=2Dž\vHHCouldn't create a search context. ERROR: Couldn't allocate memory in read_record() ERROR: Couldn't open $MFT/$DATAERROR: Couldn't read MFT Record %lld. ERROR: Couldn't allocate memory in get_filenames(). ERROR: Couldn't allocate memory in get_parent_name() ERROR: Couldn't create a search context. ERROR: Couldn't get filenames. ERROR: Couldn't allocate memory in get_data(). ERROR: Cannot translate name into current locale. ERROR: Couldn't get data streams. %-8lld %c%c%c%c %3d%% %s %9lld %s Metadata may span more than one MFT record ________________________________________ Amount potentially recoverable %d%% File is encrypted, recovery is impossible. File is compressed, recovery not yet implemented. File is resident, therefore recoverable. File has no runlist, hence no data. File has an empty runlist, hence no data. Missing segment at beginning, %lld clusters Missing segment at end, %lld clusters ERROR: Unexpected error whilst calculating percentage for inode %lld Internal error, strtoll didn't return a suffix. Invalid size suffix '%s'. Use T, G, M, or K. Can't read info from mft record %lld. File has no recoverable data. File has no data. There is nothing to recover. Missing segment at beginning, %lld clusters. Missing segment at end, %lld clusters. Truncation not performed because file has an inconsistent $MFT record. ERROR: Couldn't set the file's date and time Undeleted '%s:%s' successfully to %s. Undeleted '%s' successfully to %s. ERROR: Couldn't open $MFT/$BITMAPERROR: Couldn't allocate memory in scan_disk() ERROR: Couldn't create a regex. Inode Flags %%age Date Time Size Filename ----------------------------------------------------------------------- Couldn't read MFT Record %lld. Couldn't compare filename with regexERROR: Failed to undelete inode %lli ! Files with potentially recoverable content: %d ERROR: Couldn't alloc mem for parsing inodes! ERROR: Missing new value at end of input! Pattern to transform is empty Couldn't allocate memory in transform() Invalid time suffix '%s'. Use Y, M, W, D or H. Option '%s' requires an argument. -b:Cc:d:fh?i:m:o:OPp:sS:t:TuqvVYou must specify exactly one device. Scan can only be used with --percent, --match, --ignore-case, --size and --time. The --case option doesn't make sense without the --match option Copy can only be used with --output and --destination. You can only select one of Scan, Undelete or Copy. Percentage value must be in the range 0 - 100. You may not use --quiet and --verbose at the same time. You may not use --quiet when scanning a volume. To use --parent, you must also use --verbose. %s v%s (libntfs-3g) - Recover deleted files from an NTFS Volume. Copyright (c) 2002-2005 Richard Russon Copyright (c) 2004-2005 Holger Ohmacht Copyright (c) 2005 Anton Altaparmakov Copyright (c) 2007 Yura Pakhuchiy Copyright (c) 2013-2018 Jean-Pierre Andre Developers' email address: ntfs-3g-devel@lists.sf.net This program is free software, released under the GNU General Public License and you are welcome to redistribute it under certain conditions. It comes with ABSOLUTELY NO WARRANTY; for details read the GNU General Public License to be found in the file "COPYING" distributed with this program, or online at: http://www.gnu.org/copyleft/gpl.html Usage: %s [options] device -s, --scan Scan for files (default) -p, --percentage NUM Minimum percentage recoverable -m, --match PATTERN Only work on files with matching names -C, --case Case sensitive matching -S, --size RANGE Match files of this size -t, --time SINCE Last referenced since this time -u, --undelete Undelete mode -i, --inodes RANGE Recover these inodes -o, --output FILE Save with this filename -O, --optimistic Undelete in-use clusters as well -d, --destination DIR Destination directory -b, --byte NUM Fill missing parts with this byte -T, --truncate Truncate 100%% recoverable file to exact size. -P, --parent Show parent directory -c, --copy RANGE Write a range of MFT records to a file -f, --force Use less caution -q, --quiet Less output -v, --verbose More output -V, --version Display version information -h, --help Display this help Failed to set locale, using default '%s'. Error getting information about %sFailed to determine whether %s is mountedUse the force option to ignore this error. Access is denied because the NTFS volume is already exclusively opened. The volume may be already mounted, or another software may use it which could be identified for example by the help of the 'fuser' command. You can use force option to avoid this check, but this is not recommended and may lead to data corruption. The device '%s' doesn't have a valid NTFS. Maybe you selected the wrong device? Or the whole disk instead of a partition (e.g. /dev/hda, not /dev/hda1)? Or the other way around? NTFS is inconsistent. Run chkdsk /f on Windows then reboot it TWICE! The usage of the /f parameter is very IMPORTANT! No modification was made to NTFS by this software. The NTFS partition is hibernated. Please resume Windows and turned it off properly, so mounting could be done safely. Access is denied because the NTFS journal file is unclean. Choices are: A) Shutdown Windows properly. B) Click the 'Safely Remove Hardware' icon in the Windows taskbar notification area before disconnecting the device. C) Use 'Eject' from Windows Explorer to safely remove the device. D) If you ran chkdsk previously then boot Windows again which will automatically initialize the journal. E) Submit 'force' option (WARNING: This solution it not recommended). F) ntfsmount: Mount the volume read-only by using the 'ro' mount option. You seem to have a SoftRAID/FakeRAID hardware and must use an activated, different device under /dev/mapper, (e.g. /dev/mapper/nvidia_eahaabcc1) to mount NTFS. Please see the 'dmraid' documentation for help. Volume is scheduled for check. Please boot into Windows TWICE, or use the 'force' option. NOTE: If you had not scheduled check and last time accessed this volume using ntfsmount and shutdown system properly, then init scripts in your distribution are broken. Please report to your distribution developers (NOT to us!) that init scripts kill ntfsmount or mount.ntfs-fuse during shutdown instead of proper umount. WARNING: Dirty volume mount was forced by the 'force' mount option. ERROR: Failed to scan device '%s'. ERROR: NO inode(s) AND NO match-regex specified! Inode Flags %%age Date Size Filename Couldn't allocate memory in copy_mft() Couldn't create output file '%s'ERROR: Failed to read MFT blocks %lld-%lld. utils.cntfsundelete.cRecovered file name %s %F %RDirectoryFileMFT Record %lld Type: %s Date: %s Data Streams: Filename: (%d) %s File Flags: System Directory Sparse Reparse Compressed Encrypted Parent: %s Size alloc: %lld Size data: %lld Date C: %s Date A: %s Date M: %s Date R: %s Name: %s Resident Compressed Encrypted Size init: %lld Size vcn: %lld Data runs: None %lld @ %lld Creating file: %s Couldn't open $BitmapCouldn't read $BitmapFile has no data streams. File is %d%% recoverable Invalid size '%s'. unknown%s/%s:%s%s/%s.%dRecord is in use by the mft Forced to continue. %s%lldCouldn't create file %sFile has resident data. Write failedClose failedFile has a sparse section. Read failedTruncation failedmftUnknown option '%s'. ERROR: Invalid Number: %s ERROR: Missing range end! Invalid time '%s'. 2022.10.3ntfsundelete %s %s%s The device %s doesn't exist Failed to mount '%s'Range to copy is backwards. Couldn't open $MFT/$DATACouldn't read MFT Record %lldRead %lld MFT Records MFT extracted to file %s bytecasecopydestinationforcehelpinodesmatchoptimisticoutputparentpercentagequietscansizetimetruncateverboseversionhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh"s0$όއ݉mQƇ-------~----------z-----------------~----------zߙ............Y.....2utils_parse_sizeutils_cluster_in_usefind_first_attributedump_recordparse_inode_argtransformparse_timeversionusageparse_optionsutils_set_localeutils_valid_deviceutils_mount_volumehandle_undeletecopy_mftmainname_matchscan_diskset_dateundelete_fileopen_filelist_recordcalc_percentageverify_parentget_parent_namerescue_nameget_filenamesget_dataread_record.*\.;x| |@p`00d X x``0`@zRx &D$4x0FJ w?9*3$"\{t{ 0(JC BFFEBBA $ĘAC CK F ,L* AC M G ,LAC HEQ F 0HkAW BEIFH B 4|AC MP G P H ^ PaA` Al $@AC I A 8JC FJ C   $8,mAC I D (`tAC K K ,(\AC HK D ,Xt AC P I ,JAC P5 A ,x{"EC HH7 A @P@yb~CcdfhimOoPŠpРq֠s۠StTuvV=N s08o   PH oo oo\ o0 @ P ` p !! !0!@!P!`!p!!!!!!!!!"" "0"@"P"`"p"""""""""## #0#@#/usr/lib/debug/.dwz/x86_64-linux-gnu/ntfs-3g.debug$G[ow(؎~ ad3c1b5c492a764bca0477e62eb7832bc9227a.debugq.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.data.rel.ro.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink 880&hh$9 Go$Q Y ao\ \ ~no p}PPHB  0P#P#`#`# &&JMss @'@@L0088@@    G `4/