3

I recently encountered a strange Windows 7 bug where a 600 MB video file I spent ~1 hour recording disappeared with no trace. I've tried using applications such as Recuva to see if I can recover it to no avail.

I know for sure that the file existed at one point because there is still a link to its location in VLC Media player's history. That said, there SHOULD be a reference to the data write operations in the NTFS $LogFile on the volume where this file was created. Whenever I try to do a 'type $Logfile' or open it through an application I get "Access is Denied". I am logged in as an account with Local Administrator privileges.

Does anyone know a surefire method of viewing the NTFS $LogFile for a given volume?

tshepang
  • 12,111
  • 21
  • 91
  • 136
Tom A.
  • 125
  • 1
  • 2
  • 7

2 Answers2

3

nfi.exe should help. take a look at the following question:

How to dump the NTFS $Bitmap file

Community
  • 1
  • 1
mox
  • 6,084
  • 2
  • 23
  • 35
0

Try fget or ntfs opt, see here: http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html

tal
  • 111
  • 3