Recovery data of deleted files from NTFS drive

Recovering deleted files in NTFS is easier than in most file systems. When a file is deleted, the name is removed from the parent directory index, the MFT entry is unallocated, and the clusters are unallocated. Microsoft does not clear any of the pointers, although they could in the future if they wanted to.

The big disadvantage of NTFS is that when the file name is removed from the parent directory index, the index is re-sorted and the name information could be lost. Therefore, you may not see the name of the deleted file in its original directory. This disadvantage is offset, though, because the MFT entries are found in one table, so all unallocated entries can be easily found. Further, each entry has the $FILE_NAME attribute with the file reference address of the parent directory. Therefore, when an unallocated entry is found, we can typically determine its entire path, unless any of the parent directories have been reallocated to a new file or directory.

Another consideration when recovering deleted NTFS files is to look for additional $DATA attributes. You can test your NTFS data recovery programs using a test image from the DFTT site. This image contains deleted files with multiple $DATA attributes that do not have an index entry pointing to them.

To recover all deleted files in NTFS, the MFT should be examined for unallocated entries. When they are found, the name can be determined using the $FILE_NAME attribute and the parent directory file reference. The cluster pointers should still exist, and the data can be recovered if it has not been overwritten. Recovery is possible even if the file was very fragmented. If the attribute value was resident, the data will not be overwritten until the MFT entry is reallocated. If the file needed more than one MFT entry to store its attributes, the other MFT entries may be needed for the recovery. Windows uses a first-available allocation strategy for MFT entries, so the low-numbered MFT entries could be allocated more frequently than the high numbered entries.

When recovering files or examining deleted content, the file system log or change journal could be useful for recent deletions. The change journal is not always enabled, but it shows when the file was deleted and when it was last edited.

Hetman Uneraser reliably recovers all types of data from any logical volumes with NTFS file system, including formatted, deleted, and even inaccessible NTFS volumes.

You can download Ntfs data recovery softwarefor free and see for yourself how fast you can find the files that you deleted days ago!Trial version allows you to scan the hard drives and find the necessary NTFS files are available for recovery. To save the recovered files, you will need to purchase Ntfs data recovery software.