this is obsolete doc -- see http://doc.nethence.com/ instead

NTFS undelete from a Linux system 

Requirements 

Make sure you've got ntfsundelete available, 

which ntfsundelete

Note. it comes with ntfs-3g 

Usage 

Unmount the volume, 

umount /dev/sdb2

Look for fully recoverable files, then for last two monthes only, 

ntfsundelete /dev/sdb2 -p100

ntfsundelete /dev/sdb2 -p100 -t2m

Either undelete the precise files you need, 

mkdir -p /data/undelete/

ntfsundelete /dev/sdb2 (-p100 -t2m) -u -d /data/undelete/ -i INODE_NUMBER

all the fully recoverable files, for last two monthes, ending with the mp3 extension, 

ntfsundelete /dev/sdb2 -p100 -t2m -u -d /data/undelete/ -m'.mp3'

all the fully recoverable files, for last two monthes, for last two monthes, 

ntfsundelete /dev/sdb2 -p100 -t2m -u -d /data/undelete/ -m'*'

References 

http://www.tuxera.com/community/ntfs-3g-download/