Home

It is a fairly common problem that many PCs these days are shipped with a recovery mode for the operating system that will reload a completely clean copy of the operating system, and not retain the files. Fortunately, this reloading does not normally include a re-format, so the files do still exist, but cannot be accessed.

To recover the files, one way is to track down all the old MFT entries.  The new installation of the operating system will create a new MFT file, ie the index to all files, and the new MFT will be fairly short, ie just long enough for the files currently on the disk, maybe 10,000 files. To recover the older files, it is necessary to find the original MFTs. As all indexing of the locations of the MFTs is probably lost, the only way to work is to scan the whole drive. For this reason, on the NTFS options screen, one needs to select both the radio button and check box

• From File entries
• Scan all MFT entries.

When the Recover All, or Select Files button is pressed, the whole drive will be scanned.  If a scan of the whole drive is not required, the End Scan value can be reduced from it's default maximum value.  In the same way, the start value could be increased.  This setting of start and end is also useful if necessary to skip some of the media due to complete, or excessive sector failures. When scanning, the display will indicate progress, as well as the number of MFTs and Boot sectors found. If Cancel is pressed on the scan, the scan for MFTs will be cancelled, and the process will continue with file recovery, based on the number of MFTs detected to the point the cancel button was pressed.

File recovery mode works in two passes.  The first pass will recover all known good files, ie ones from the current NTFS disk.  The second pass will then recover all files that have been located from the scanned MFTs, as well as deleted files.  The reason for this dual pass is so that file can be detected that could have been overwritten, or partially overwritten.

Files that are recovered, as part of the second pass are stored in a directory !recover

Files that are thought to be partially overwritten, are stored in a directory overwrite, or overwrite\!recover.  Overwritten files are often corrupt, but can always be tried, as they contain the information / file data required.

Files recovered, but not valid, or subdirectories wrong

The most likely explanation for this is that the drive partitions are incorrect. Locations of files, as stored in an MFT is relative to the partition that the MFT is in.  The starting point to fix this will be to run the partitions program and search for previous partitions