ntfsundelete /dev/sda1 -p 100 | awk '{print $1}' | egrep "^[[:digit:]]" | while read inode; do ntfsundelete -u -i${inode} -d /tmp/recovered/ /dev/sda1 ; done