NTFS undelete on Linux

To avoid damaging filesystem with files to be undeleted I created image of entire hard disk by booting live linux on source PC from USB and then making 1:1 copy of HDD with dd.