Recovering Compressed NTFS Files

Below, we’ll have a closer look on opportunities to recover files compressed with NTFS tools. To learn more about recovering protected and encrypted files, please read our article called Recovering Protected and Encrypted NTFS Files. Later on, we will consider the possibilities of recovering files compressed using the standard means of the NTFS file system.

Recovering Compressed NTFS Files

NTFS File Compression

On-the-fly compression was new to NTFS, allowing users to trade off some extra disk space for a little performance without sacrificing convenience. The fully transparent compression shrinks files, folders or entire disks, allowing to use disk space more effectively. Doing it is extremely easy – just select a file, the “My Documents” folder, your desktop or a disk, and set a corresponding flag in the extended attributes dialog.

Unfortunately, data recovery tools unaware of the specific compression algorithms used in NTFS encryption will lose much of their functionality when accessing the disk in low-level mode. Low-level access will return compressed binary stream instead of the content of actual files, effectively rendering signature-search algorithms completely useless. Data recovery tools unaware of NTFS compression will fail to recover compressed files in a case the file system is broken.

File attributes

Recovering NTFS Compressed Files

The issue of recovering NTFS-compressed files is complicated enough to make it worthy of a scientific research. Korean researchers Byeongyeong Yoo, Jungheum Park, Sungsu Lim, Jewan Bang and Sangjin Lee published several whitepapers such as “A study on multimedia file carving method” exploring this very issue. While their research mostly refers to forensic investigations, they developed a file carving algorithm using a variation of signature-search method widely employed in data recovery. According to the researchers, their “…file carving(algorithm) recovers files using the inherent header and footer in files or the entire file size determined in the file header”.

Re-creating the very complex algorithms implemented by Microsoft in the NTFS in order to gain binary, raw-mode access to compressed files is extremely complicated. For this reason, whatever support there is for compressed NTFS files is currently only available in certain high-end and very expensive digital forensic tools.

Go to view
Restoring a Deleted Folder from Recycle Bin, Archive or with Specialized Software 📁⚕️👨‍💻

Restoring a Deleted Folder from Recycle Bin, Archive or with Specialized Software 📁⚕️👨‍💻

Tools and Limitations

Does it mean that compressed NTFS files cannot be recovered? Absolutely not! The better NTFS recovery tools will correctly process the compressed files. However, the recovery of NTFS-compressed files carries a number of restrictions and limitations, making the ability of a given tool to recover a given file under given circumstances a case-by-case issue.

The program for recovering data from NTFS after formatting partition or deleting files.

NTFS recovery tools such as Hetman NTFS Recovery will be able to access and recover compressed files under certain conditions. Hetman NTFS Recovery will use Windows API to access the compressed files (as opposed to direct disk access when reading the disk in raw mode). Thus the recovery of compressed files will depend on whether or not the disk API is still able to read the file. For example, undeleting compressed files located on a healthy disk is no different to undeleting any other type of file. Recovering NTFS-compressed files from formatted NTFS disks is generally not a problem. However, if the file system is badly damaged, the chances of correctly recovering NTFS-compressed files are lower than those for non-compressed ones. It’s always worth a try to see if your files in your situation are actually recoverable.

Go to view
How To Recover Data From System NTFS Partition in 2020 With Hetman NTFS Recovery Software 📁🔥⚕️

How To Recover Data From System NTFS Partition in 2020 With Hetman NTFS Recovery Software 📁🔥⚕️

Oleg Afonin

Author: , Technical Writer

Oleg Afonin is an expert in mobile forensics, data recovery and computer systems. He often attends large data security conferences, and writes several blogs for such resources as xaker.ru, Elcomsoft and Habr. In addition to his online activities, Oleg’s articles are also published in professional magazines. Also, Oleg Afonin is the co-author of a well-known book, Mobile Forensics - Advanced Investigative Strategies.

Vladimir Artiukh

Editor: , Technical Writer

Vladimir Artiukh is a technical writer for Hetman Software, as well as the voice and face of their English-speaking YouTube channel, Hetman Software: Data Recovery for Windows. He handles tutorials, how-tos, and detailed reviews on how the company’s tools work with all kinds of data storage devices.

Recommended For You

Hello! This is AI-based Hetman Software virtual assistant, and it will answer any of your questions right away.
Start Chat