Tink vs ntfsundelete
ntfsundelete restores deleted files from an NTFS MFT. That is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
ntfsundelete undeletes the files. Tink answers “why is this VPS sick?”
Accidental sysadmins land on ntfsundelete because a free NTFS undelete looks like insurance. Then the host volume fills, nginx dies, and the last -s scan table still looks complete — no -u match for host fill. A filling /var is a Tink warning; it is not an ntfsundelete job unless you scraped recovery mail and watched it.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using ntfsundelete if you already run NTFS MFT undelete. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | ntfsundelete |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — unmount the NTFS volume, run ntfsundelete /dev/sdXn -s, pick -u/-m patterns or -i inodes, -o output, then a host that still has no mechanic after the last scan finished |
| What you get | Working monitoring, diagnosis, and approved fixes | An NTFS undelete CLI. Disk fill, nginx, Postgres, and certs stay your problem until you SSH past the last recovered inode |
| Pricing | Free (Scout) / $9 / $29 per machine per month | GPL and free (ntfsprogs / ntfs-3g). You still pay the person who owns the VPS after the last ntfsundelete -u looks finished |
| Hidden costs | None — fully managed | A quiet recovered-files tree that is not host fill, downtime to unmount the NTFS volume, MFT-percent homework, and a second tool to tell you the box is sick while the last -s still showed complete |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | ntfsundelete -s, -u, -m match, -p percent, -i inodes. ntfsundelete does not watch a quiet cert or host auth.log after the last undelete session ended |
| Configuration | None after install — heuristics and AI | Which /dev/sdXn to scan, -s vs -u, -m glob vs -i inode, destination -o, and which failed ntfsundelete session actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You read the ntfsundelete scan table and recovered files, then SSH into the host to change the Linux box ntfsundelete already undeleted files off |
| Fix execution | Proposes and executes approved commands with an audit trail | Restore MFT records from NTFS — ntfsundelete cannot free host disk, rotate a cert, or stop SSH brute-force unless you run ntfsundelete again |
| Alerting | Built-in across 8 channels | Not an ntfsundelete job — cron mail from a failed undelete plus a separate monitoring tool have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not an ntfsundelete job — a recovered inode date does not forecast a quiet host filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — ntfsundelete does not read host auth.log, journald, or firewall state after the last undelete session ended |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the host dies after the last ntfsundelete -u — unless you built a separate uptime check |
| Public status page | Shareable URL with 90-day history | None — ntfsundelete has no customer-facing status page for the Linux host |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a recovered-inode recap is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire failed ntfsundelete restores into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | The ntfsundelete CLI, MFT scan table, and SSH. No mechanic you text when /var filled and the last -s still showed complete |
| Learning curve | None — works after install | Steep — unmount first, -s vs -u vs -m, -p percent, destination -o, and which failure is the undelete vs the running host |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already run ntfsundelete for NTFS MFT undelete, not a sick-VPS mechanic |
When ntfsundelete is the right choice
Keep using ntfsundelete when you already want that exact job:
- NTFS undelete — you need ntfsundelete -s, -u, -m patterns, or -i inodes, not a mechanic.
- An existing recovery stack — unmounted NTFS volumes, MFT percent scores, and a lab LAN matter more than guest nginx, certs, and SSH on a quiet VPS.
- An existing lab or nested setup — ntfsundelete already runs, recovered files already exist, and someone owns the unmounted disk.
- Hosts that only page on undelete death — you already run failed-restore mail, not a sick-box SSH loop.
The real cost of “just run ntfsundelete”
ntfsundelete undeletes files. A working ops loop for five Linux boxes is not:
- A healthy -s pass still means you SSH into the host and change the box by hand when it gets sick later
- Host fill, nginx, certs, and SSH brute-force never appear unless a separate tool scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — ntfsundelete will stay quiet until the next undelete session
- A single VPS with a dead agent still needs a mechanic, not another ntfsundelete -u
For a 5-server team, Tink Mechanic at $45/month is cheaper than the engineer who keeps failed-restore notifications alive after a green ntfsundelete session, and every scan includes a diagnosis a quiet recovered-inode tree will not type.
No MFT scan table or percent-recoverable homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs extundelete · Tink vs ext4magic · Tink vs TestDisk