Is there any value in continuing search once "O/S Items Found" levels out?

[jsstevenson]

Hello....

I am currently 'searching' a corrupted harddrive with 1no. NTFS partition on it using the "Complete Format Recover" option. It appears that the MFT is corrupted.

I have read the 'sticky' titled "How to recover a formatted hard drive" and notice that step 6 advises that once the "OS Items Found number reaches a very high number, stops increasing, and remains constant, you can press the STOP button". For me this appears to have happened with 22108 "OS Items Found". This figure has remained constant for the past 30 minutes, though I know that there are many more files on the drive than the number so far found.

The thing is, the search has thus far only searched 8million of the 398million sectors on the drive, so the question is... will leaving the software to search all 398million sectors of the drive likely result in additional OS Items being found, or is it likely that all MFT records pointing to data will have already been found?

If I understand correctly, the OS Items Found will not necessarily be in the currently searched sectors but instead the recoverable entries in the MFT may have been found in the currently searched sectors?

Any comments would be very welcome.

Thanks
Jamie.

p.s. Based on some reading and thinking about the question I have posed.... as I understand it, the MFT can become heavily fragmented, thus is it possible that scanning the whole disk would in fact be worthwhile on the assumption that some of the MFT entries could be stored anywhere on the disk thus to ensure all MFT listed data is restored then the whole drive should be scanned?

[GDH]

Hi,

Yes, if you know there are more than 22,000 files on the disk then you should leave the search running.

If you wish, you can leave the Complete Format Recover run all the way to the end of the drive - there is no problem with doing this, it just takes more time.

Yes, it is fairly rare, but possible to get fragments of MFTs spread out over the disk - so in your case it is worth letting the search continue.

It is also possible that your old MFT has been destroyed. If this is the case then you need to recover the files you will need to run a "Complete File Search" to find specific file types by their header and footer.

Good luck.

[jsstevenson]

Thanks for your reply....

Initially the program found over 22,000 OS items somewhere between sector 6,000,000 and sector 8,000,000. I left the prgram to run and somewhere between sector 100,000,000 and sector 120,000,000 it found another 43,000 OS items bringing the grand total to approx 65,000 OS Items. So in this case letting it run on was good and it has more-or-less found all of the lost items with full attributes intact! Good program.

Again, thanks.
Jamie.

[GDH]

Hi,

Thanks for the feedback. Good to hear your data recovery was sucessful.