help need recover data

[terry brian]

Hello,

Some of my files are gone, and what tool can bring them back? filesystem NTFS, but I need the really powerful tool as the files are important.

[chris]

This isn't anything to do with xatshow is it?

Chris.

[†Justin† MêЙ]

Try the NTFS5

It's Disk Scan is a process of low-level enumeration of all entries in the Root Folders on FAT12, FAT16, FAT32 or in Master File Table (MFT) on NTFS, NTFS5. The goal is to find and display deleted entries.

In spite of different file/folder entry structure for the different file systems, all of them contain basic file attributes like name, size, creation and modification date/time, file attributes, existing/deleted status, etc...

Given that a drive contains root file table and any file table (MFT, root folder of the drive, regular folder, or even deleted folder) has location, size and predefined structure, we can scan it from the beginning to the end checking each entry, if it's deleted or not and then display information for all found deleted entries.


Deleted entries are marked differently depending on the file system. For example, on FAT any deleted entry, file or folder are marked with ASCII symbol 229 (0xE5) that becomes the first symbol of the entry. On NTFS deleted entry has a special attribute in file header that points whether the file has been deleted or not.
To define clusters chain we need to scan drive, going through one by one all file (NTFS) clusters or free (FAT) clusters belonging (presumably) to the file until we reach the file size equals to the total size of the selected clusters. If the file is fragmented, clusters chain will be composed of several extents in case of NTFS, or we take clusters bypassing occupied ones in case of FAT.

Location of these clusters can vary depending on file system. For example, file deleted on FAT volume has its first cluster in its Root entry, the other clusters can be found in File Allocation Table. On NTFS each file has _DATA_ attribute that describes "data runs". Disassembling data runs to "extents" for each extent we have start cluster offset and number of clusters in extent, so enumerating extents, we can compose file's cluster chain.

You can try to define clusters chain manually, using low-level disk editors, however it's much simpler to use data recovery tools, like Active@ UNERASER. After clusters chain is defined, automatically or manually, the only task left is to read and save contents of the defined clusters to another place verifying their contents.

We have a chain of clusters; we can calculate each cluster offset from the beginning of the drive, using standard formulas. After that we copy amount of data equals to the cluster size, starting from the calculated offset into the newly created file. For the last one we copy not all cluster, but reminder from the file size minus number of copied clusters multiplied by cluster size.

Formulas for calculating cluster offset could vary depending on file system.

To calculate, for example, offset of the cluster for FAT we need to know:

Boot sector size
Number of FAT supported copies
Size of one copy of FAT
Size of main root folder
Number of sectors per cluster
Number of bytes per sector
On the NTFS, we have linear space so we can calculate cluster offset simply as cluster number multiplied by cluster size. "cheers" Hope that helps you a bit.

__Justin

[KennyK]

Hello,

Some of my files are gone, and what tool can bring them back? filesystem NTFS, but I need the really powerful tool as the files are important.

You can try a free FreeUndelete ( http://recovery-review.com/undelete-tools/freeundelete-2-0-0635.html ), but if it won't help, look for some shareware recovery app there, for example DiskInternals Uneraser, GetDataBack or Back2Life...

[JessalynnSakura]

You can try a free FreeUndelete ( http://recovery-review.com/undelete-tools/freeundelete-2-0-0635.html ), but if it won't help, look for some shareware recovery app there, for example DiskInternals Uneraser, GetDataBack or Back2Life...

well some things get lost. what might of happend is that the site was not done loading or you miss-placed it or you hit the wrong thing to save. my advice is before you save everything write them all on a peice of paper so when it gets lost you can type it again and there it will be.....well.....lets hope!
from, JessalynnSakura

[Catrina]

ah I see an other problem solved or almoust solved..