Ntfs recovery tools

Please make sure that all required file system drivers are loaded and that the volume is not corrupted. Besides that, you might find the partition becomes RAW in Disk Management or shows 0 bytes in its properties. In such cases, you will lose the accessibility to this partition and the data inside it. So you might be searching for effective NTFS file system repair solutions to restore the accessibility. In this guide, we would like to share some proven methods to help you repair the damaged NTFS file system.

Then navigate to "Tools" tab and click "Check" under "Error Checking". That option will check the selected partition for file system error. Click "Start" button, input "cmd" in the Search bar, right-click the "Command Prompt" icon and select "Run as administrator".

For this, you can make use of Diskpart tool to force format the damaged partition. First, open the Command Prompt window, then run the following commands in order. Now you can download the freeware and have a try. FAT File Systems. Volume Structure. Windows Storage Spaces. LSoft Data Recovery Products. Learn more. Active File Recovery Active File Recovery effectively detects and recovers files lost due to accidental deletion, disk formatting, disk damage, virus attack and other reasons.

MBR loader looks for the "active" partition, i. It means that the loader cannot determine which partition is system and active to pass control to. Loader will try to boot from there, fails, try to boot again from other devices like floppy, and if fails to boot again, we'll see an error message like "Non-System Disk or Disk Error".

If we try to boot now, the previous second FAT partition becomes the first and the loader will try to boot from it. And if it's not a system partition, we'll get the same error messages. If we try to boot now, the MBR loader will try to read and interpret zeros or other garbage as partition parameters and we'll get an error message like "Missing Operating System".

Thus, the second step in partition recovery is to run Disk Viewer and to make sure that the proper partition exists in the partition table and has been set as active. Because if recovery software finds it, all necessary parameters to reconstruct partition entry in the Partition Table are there. What would happen if partition entry had been deleted then recreated with other parameters and re-formatted?

In this case, instead of the original partition entry we would have a new one and everything would work fine except that later on we could recall that we had some important data on the original partition. Some advanced recovery tools also have an ability to scan disk surface and try to reconstruct the previously deleted partition information from the pieces of left information i. However it is not guaranteed that you can recover something. The Partition Boot Sector contains information, which the file system uses to access the volume.

On personal computers, the Master Boot Record uses the Partition Boot Sector on the system partition to load the operating system kernel files. Partition Boot Sector is the first sector of the Partition. The remaining code is the bootstrap code that is necessary for the proper system boot and the end of sector marker shown in bold print.

This sector is so important on NTFS, for example, duplicate of the boot sector is located on the disk. After we fail to load from it and from floppy, partition becomes unbootable. Because a normally functioning system relies on the boot sector to access a volume, it is highly recommended that you run disk-scanning tools such as CHKDSK regularly, as well as back up all of your data files to protect against data loss in case you lose access to the volume.

If duplicate boot sector is not found, only virtual partition recovery might be possible if we can determine critical partition parameters such as Sectors per Cluster, etc.. It can try to find out duplicate boot sector on the drive and re-create the original one or perform virtual data recovery based on found partition parameters.

Some advanced techniques allow assuming drive parameters even if duplicate boot sector is not found i. For Operating System to boot properly, system files required to be safe. Windows Vist and newer Windows versions have completely different set of boot system files. If these files have been deleted, corrupted, damaged by virus, Windows will be unable to boot. So, the next step in recovery process is to check the existence and safety of system files for sure, you won't able to check them all, but you must check at least NTLDR,ntdetect.

This disk is recommended to create after you install and customize Windows. To create it, use the "Backup" utility from System Tools. If you do not have an ERD, the emergency repair process can attempt to locate your Windows installation and start repairing your system, but it may not be able to do so.

To run the process, boot from Windows bootable disks or CD, and choose Repair option when system suggests you to proceed with installation or repairing.

Fast Repair is recommended for most users, Manual Repair — for Administrators and advanced users only. If the emergency repair process is successful, your computer will automatically restart and you should have a working system.

You can list and display folder content, copy, delete, replace files, format drives and perform many other administrative tasks. To run Recovery Console, boot from Windows bootable disks or CD and choose Repair option, when system suggests you to proceed with installation or repairing and then press C to run Recovery Console.

You will be asked to which system you want to log on to and then for Administrator's password, and after you logged on — you can display drive's contents, check the existence and safety of critical files and, for example, copy them back if they have been accidentally deleted. Third party recovery software in most cases does not allow you to deal with system files due to the risk of further damage to the system, however you can use it to check for the existence and safety of these files.

File recovery process can be briefly described as drive or folder scanning to find deleted entries in Master File Table MFT then for the particular deleted entry, defining clusters chain to be recovered and then copying contents of these clusters to the newly created file. Different file systems maintain their own specific logical data structures, however basically each file system:.

After finding out the proper file entry and assembling set of clusters, composing the file, read and copy these clusters to another location. First , we assume that the file entry still exists not overwritten with other data. The less the files have been created on the drive where the deleted file was resided, the more chances that space for the deleted file entry has not been used for other entries. Second , we assume that the file entry is more or less safe to point to the proper place where file clusters are located.

In some cases it has been noticed in Windows XP, on large FAT32 volumes operating system damages file entries right after deletion so that the first data cluster becomes invalid and further entry restoration is not possible.

Third , we assume that the file data clusters are safe not overwritten with other data. The less the write operations have been performed on the drive where deleted file was resided, the more chances that the space occupied by data clusters of the deleted file has not been used for other data storage. Even file recovery software installation could spoil your sensitive data.

If the data is really important to you and you do not have another logical drive to install software to, take the whole hard drive out of the computer and plug it into another computer where data recovery software has been already installed or use recovery software that does not require installation, for example recovery software which is capable to run from bootable floppy. It's better to save data onto another logical, removable, network or floppy drive. The goal is to find and display deleted entries.

Given that a drive contains root file table and any file table MFT, root folder of the drive, regular folder, or even deleted folder has location, size and predefined structure, we can scan it from the beginning to the end checking each entry, if it's deleted or not and then display information for all found deleted entries. Deleted entries are marked differently depending on the file system. On NTFS deleted entry has a special attribute in file header that points whether the file has been deleted or not.

Thus we can iterate through all MFT records, starting from the absolute offset 0x on the volume looking for the deleted entries. MFT Record has pre-defined structure. It has a set of attributes defining any file of folder parameters. The most important information for us in this block is a file state: deleted or in-use.

If Flags in red color field has bit 1 set, it means that file is in-use. In our example it is zero, i. Following standard attribute header, we have File Name Attribute belonging to DOS name space, short file names, third bold section, offset 0xA8 and again following standard attribute header, we have File Name Attribute belonging to Win32 name space, long file names, third bold section, offset 0x :. In our case from this section we can extract file name, "My Presentation.

To define clusters chain we need to scan drive, going through one by one all file NTFS clusters belonging presumably to the file until we reach the file size equals to the total size of the selected clusters.

If the file is fragmented, clusters chain will be composed of several extents in case of NTFS. Location of these clusters can vary depending on file system. Disassembling data runs to "extents" for each extent we have start cluster offset and number of clusters in extent, so enumerating extents, we can compose file's cluster chain.

Data Runs need to be decrypted. First byte 0x31 shows how many bytes are allocated for the length of the run 0x1 in our case and for the first cluster offset 0x3 in our case.