Home

Often with a hard drive a file or folder may go missing.  This could be operator error, or a sector has failed within a directory tree.  The following tools and procedures may assist in recovering such a file.

If a disk is fairly new the Wizard gives an indication of the number of sectors of a disk that have been used as a percentage of the whole disk.  Thus if the wizard says a 100GB  disk is 80% full and only 20GB of files can be found, it is possible that there 60GB lost or hiding.  However, an, or well used disk will slowly write on all sectors of the disk, so this figure should be used with caution.

Recovery is dependant on the media and operating system used so the instructions below are system dependant.

FAT lost file recovery

On the FAT recovery menu there are a few very useful options.  For deleted files there is an option button to recover deleted files.  This will copy the files that have been deleted.  Often the full filename will be restored, but on short file names, the file name may start with a '!' as the first character of the file name is use to indicate that it has been deleted.

When files or directories are missing, the 'Recover from Directory Stubs' can be very useful. In this mode the whole disk is scanned for subdirectories.  It will therefore pick up directories that have otherwise been disconnected from the main directory structure. This can be caused by a sector failure or a glitch when updating directories. As this procedure is a brute force method, there may be cases when totally irrelevant directory stubs are detected, or the same one found more than once.

NTFS lost file recovery

NTFS is well structured to recover any file that has otherwise been lost.  Each file has an entry in the MFT (Master File Table) and so by searching the disk for all MFT entries, most files can then be found.  Each entry in the MFT starts with the letters FILE0 or FILE*, and there are also sumchecks to add to the search criteria.

On normal reading of a disk, the MFT is navigated using Index files, and if one of these is corrupted or damaged parts of the directory tree will not be found. By using the recovery option 'From directory stubs' the disk will be searched for MFT nodes. There are two ways this can be done, either by logically reading the $MFT file which is quick, or for fuller recovery, the whole disk is scanned.

When the 'From Directory Stubs' option is used it is common for a file to be found without a parent directory path.  In this case a dummy subdirectory is created, all associated files are stored in a unique directory.

As with FAT, the NTFS recover option menu has the Recover Deleted Files button.  When recovering files, these will be placed in a main subdirectory called 'DELETED'