Recovering Compressed NTFS Files
Below, we’ll have a closer look on opportunities to recover files compressed with NTFS tools. To learn more about recovering protected and encrypted files, please read our article called Recovering Protected and Encrypted NTFS Files. Later on, we will consider the possibilities of recovering files compressed using the standard means of the NTFS file system.
- NTFS File Compression
- Recovering NTFS Compressed Files
- Tools and Limitations
- Questions and answers
- Comments
NTFS File Compression
On-the-fly compression was new to NTFS, allowing users to trade off some extra disk space for a little performance without sacrificing convenience. The fully transparent compression shrinks files, folders or entire disks, allowing to use disk space more effectively. Doing it is extremely easy – just select a file, the “My Documents” folder, your desktop or a disk, and set a corresponding flag in the extended attributes dialog.
Unfortunately, data recovery tools unaware of the specific compression algorithms used in NTFS encryption will lose much of their functionality when accessing the disk in low-level mode. Low-level access will return compressed binary stream instead of the content of actual files, effectively rendering signature-search algorithms completely useless. Data recovery tools unaware of NTFS compression will fail to recover compressed files in a case the file system is broken.
Recovering NTFS Compressed Files
The issue of recovering NTFS-compressed files is complicated enough to make it worthy of a scientific research. Korean researchers Byeongyeong Yoo, Jungheum Park, Sungsu Lim, Jewan Bang and Sangjin Lee published several whitepapers such as “A study on multimedia file carving method” exploring this very issue. While their research mostly refers to forensic investigations, they developed a file carving algorithm using a variation of signature-search method widely employed in data recovery. According to the researchers, their “…file carving(algorithm) recovers files using the inherent header and footer in files or the entire file size determined in the file header”.
Re-creating the very complex algorithms implemented by Microsoft in the NTFS in order to gain binary, raw-mode access to compressed files is extremely complicated. For this reason, whatever support there is for compressed NTFS files is currently only available in certain high-end and very expensive digital forensic tools.
Tools and Limitations
Does it mean that compressed NTFS files cannot be recovered? Absolutely not! The better NTFS recovery tools will correctly process the compressed files. However, the recovery of NTFS-compressed files carries a number of restrictions and limitations, making the ability of a given tool to recover a given file under given circumstances a case-by-case issue.
NTFS recovery tools such as Hetman NTFS Recovery will be able to access and recover compressed files under certain conditions. Hetman NTFS Recovery will use Windows API to access the compressed files (as opposed to direct disk access when reading the disk in raw mode). Thus the recovery of compressed files will depend on whether or not the disk API is still able to read the file. For example, undeleting compressed files located on a healthy disk is no different to undeleting any other type of file. Recovering NTFS-compressed files from formatted NTFS disks is generally not a problem. However, if the file system is badly damaged, the chances of correctly recovering NTFS-compressed files are lower than those for non-compressed ones. It’s always worth a try to see if your files in your situation are actually recoverable.
HELP Please I cannot restore data of DSK file after save disk feature with compress contents the partitions are locked inside .dsk files and cannot be mount to Hetman app or any other apps
Thank you! Hetman NTFS Recovery really saved me. These data have been accidentally deleted by my wife. You need to put a password on your computer so that only you have access to the files. I already know how to get out of the situation if I'll accidentally delete something. By the way I have a laptop on Linux. I hope you will release your software for Unix systems.
Are there any precautions that should be taken when attempting to recover compressed NTFS files?
Yes, there are several precautions that should be taken when attempting to recover compressed NTFS files.
What are some recommended third-party software tools for recovering compressed NTFS files?
Is it possible to recover compressed NTFS files using third-party software?
Yes, it is possible to recover compressed NTFS files using third-party software. There are a variety of data recovery programs available that can help you recover compressed NTFS files. These programs use sophisticated algorithms to scan the hard drive and recover lost or damaged files.
What are the steps to recover compressed NTFS files?
What are the common causes of compressed NTFS file loss?
Read about recovering compressed NTFS files. If you do have any questions, don't hesitate to contact our technical support service - we will be happy to help you.