FAT and NTFS recovery.

Hard drives Hardware recovery File storage NTFS and FAT Recovery Software recovery

File Allocation Table (FAT) or Master File Table (MFT): NTFS recovery and FAT recovery

Microsoft has two common file storage systems known as FAT (File Allocation Table) and NTFS (New Technology File System).

The File Allocation Table file system (FAT) is a cluster based file system first developed in the mid 1970’s. Its latter version, FAT32 (released with Windows 95), is still widely used as the format for removable storage devices. This is largely due to the fact that it is a convenient way of sharing data between different operating systems. A disadvantage of FAT32 is its maximum file size limit of 4GB. In 2006 Microsoft released exFAT to address this issue and to improve performance on large media.

Every file on a FAT hard disk is stored in a directory (folder). A directory itself is considered by FAT to be a special type of file. The top level directory is referred to as the “Root”. On a FAT file system the Root directory is given special status and is usually positioned at the start of the disk. Other directories can be located anywhere in the data area of the disk.

Each file on a FAT system has a "directory entry". This is the place which stores the name of a file, the location of its starting cluster, and the size of the file. In order to find a file the Operating System uses this information to get to the first storage cluster of a file. It then uses a special table at the start of the disk know as the File Allocation Table or FAT to identify the remaining clusters that are used to store the file. It is important to realize that this information is stored completely separate from your file data and is why FAT data recovery is possible.

The NTFS File System is what you are likely to encounter on newer hard disk running operating systems like Windows 7 or 2008. Whilst an MFT is more complex, the principal of locating the start of a file and its subsequent storage clusters is essentially the same.

What happens when I delete a file?

Lets look to see what happens when you intentionally delete a file and why it may be possible to bring that file back. When you select a file and press the delete key on a Windows computer the file is sent to the Recycle Bin. You may think of the Windows Recycle Bin as just another fancy storage folder on your hard drive. The 'real' deletion (at least as far as this article is concerned) is what happens when the Recycle Bin is emptied or the deletion bypasses the Windows Recycle Bin altogether.

When a file is deleted the Operating System marks the file name in the MFT with a special character that signifies to the computer that the file has been deleted. The computer now looks at the clusters occupied by that file as being empty and therefore available space to store a new file. What the Windows Operating System does NOT do is go out to the clusters on the hard disk where the files data is actually stored and wipe the contents of these clusters. The deleted file data is still there, but the Computer Operating System no longer knows it exists.

This in fact is the underlying principal of data recovery. It is about finding data that still exists on the hard drive but which currently can't be located by the Operating System. If the clusters containing the data have are, corrupted or physically damaged, then recovering the data they once contained is impossible.

Ok, so my data is still there, but for how long? The answer to this question is completely up to you. The only way that your deleted MFT record or your file data itself will permanently be destroyed is if it is overwritten by other data. This means that any computer activity after the deletion has the potential to permanently erase otherwise recoverable files.

If you are attempting data recovery from your hard drive, if possible connect it to another computer as the slave drive so that the operating system wont be doing a merry dance over you deleted files when you attempt the recovery process. If you use data recovery software, don't install it on the drive on which the files were lost. Better yet, use a floppy disk or CD version if available. If you send your hard drive to a professional data recovery service they should not be working on the original hard drive. They should take a sector copy (an exact copy including all deleted information) of your hard drive and work on this. You may consider doing this yourself. There are a number of programs that will do this, the most common being Norton GHOST. But remember, you must make a complete sector copy of your hard drive to make sure the image includes all the deleted areas of the drive.

Data Recovery by Searching for Deleted MFT Records

Most data recovery programs search for deleted MFT entries to undelete files or unformat drives. These programs usually give a give a probability or hard drive data recovery rating of 'good', 'medium' or 'poor'. What they are actually doing is locating the MFT record for a deleted file and then checking the rest of the MFT records to determine if the clusters that the deleted file occupied are being used by any other file stored on the computer. As only one file can occupy any one cluster on a hard drive, if other files are using your deleted files storage space then it is likely that the original data has been overwritten and permanently destroyed. This recovery technique is usually relatively fast, as all the recovery program has to do is find the deleted file entries in the MFT and then go directly to that location of the hard disk to perform the data recovery. You will see an MFT search when you execute a "Fast Search" using Recover My Files Data Recovery Software.

However, if your MFT is corrupt, defective or has itself been overwritten, this method isn't going to help you get data back even though the file data still remains out on the disk waiting to be found. What you need to do is search unallocated clusters.

© GetData 2002-2024 All Rights Reserved. Recover My Files Home | Resellers | About Us | Sitemap | Privacy | User Agreement | Returns