-1

I am looking for a solution to restore deleted files on a NTFS Volume. No new files are written to the disk so all files has the condition "Excellent". But i have no storage room to copy the deleted files to another volume. Is there a program that is able to simply unflag the delete state for a file or directory without the need to copy it? All programs that i have tried want to copy the files.

Thanks for your help.

Greetz, Erwinus

Erwinus
  • 1

1 Answers1

1

My forensics is a bit rusty, but I don't think this is going to be possible. File recovery programs work by scanning the hard drive at a low level for headers and footers of files.

What it doesn't know (and can't know) is where that file sat in the file system. There is no "delete" flag - the easiest way to think of it is with the hard drive being a book and files being chapters.

The Operating System has deleted all references from the Index and Table of Contents, deleted the chapter title and ripped the pages out. So while the text still exists, you can't know what the chapter was called or where it was in the book.

Secondly, it's rule number 1 of data recovery that you never, ever, ever write to the drive you're recovering from.

Dan
  • 15,430
  • 1
  • 36
  • 67
  • Okay, thanks. But is it true that NTFS (like FAT) holds a second file table and if this is true, can i view/restore it to the master file table? – Erwinus Oct 28 '11 at 14:11
  • I never say never, but not my knowledge, no. – Dan Oct 28 '11 at 14:17