1
Hello, I work a lot with NTFS file systems. I have lost many files, due to logical and physical failures in my media. I always managed to recover some files with a lot of effort and technical research on the subject. I did a program on Pascal because I could always recover RAW files (photos, songs, etc) from a damaged drive with some tools on the market that promised it. But as the disk structure is corrupted, there is no way to know what each file is about, unless I open each one of them. So, faced with a situation where I had access to my files on disk (folders and files), but almost everything was corrupted, I created a program capable of comparing those corrupted files, with name and date of creation, with the piles of recovered RAW files. Thus, when a corrupted file has the same extension and size in bytes as another RAW file in good condition, it is assumed that the RAW file is the correct file. Then, the damaged source file is replaced optionally on another drive, which is recommended.
http://www.github.com/ngbios/mftrebuilder/
But as nothing is perfect, I realized that many files are not found raw by the recovery tools. Always when we try to copy them with recovery programs like Getdataback and the like, the file is always corrupted because the addresses of the clusters no longer match the contents of the file. But if you look in a hex editor, you end up finding the beginning of the file right in front of you. I thought maybe I could recover files this way if I found any misalignment of the original MFT addresses. For example, I have a file that starts at address 200, but logically, it starts only at address 207. Or I can have a file that starts at address 214, but is located at address 221.
Anyway, I lost my data when I corrupted the disk MBR. So, I created a cloned image from hard drive, and formatted it to continue using. But something went wrong in the image backup, which made it incomplete. Then at the end of the disk, it probably had some copy of the latest MFT. The MFT I have probably has old addresses of files that may have been relocated or have been moved with the disk defragmenter. I prefer to believe it as I have recovered many entire files,and probably this was a consequence of Windows disk defragmenter.
I wanted to exchange some experience with people who might have some solution to my problem. Maybe I can recover my data with some technique, or some software I don’t know. I’ve never seen in the market any small tool like I did. I imagine this would be very useful as many people lose files, and when they recover, they are all scrambled with numbers instead of the original file name. And if people can retrieve the MFT entries, they can get the data back, at least a few.