We are doing NTFS forensics, but not retrieving files. You can use the carver I think, but I've never tried it