up vote -1 down vote favorite
share [g+] share [fb]

I am looking for a solution to restore deleted files on a NTFS Volume. No new files are written to the disk so all files has the condition "Excellent". But i have no storage room to copy the deleted files to another volume. Is there a program that is able to simply unflag the delete state for a file or directory without the need to copy it? All programs that i have tried want to copy the files.

Thanks for your help.

Greetz, Erwinus

link|improve this question
How about plugging in a USB drive? – joeqwerty Oct 28 '11 at 14:04
What do you think, if that was possible i will have done it – Erwinus Oct 28 '11 at 14:13
Well you didn't say it, so my assumption is to not assume that you've tried anything. – joeqwerty Oct 28 '11 at 14:59
feedback

1 Answer

up vote 1 down vote

My forensics is a bit rusty, but I don't think this is going to be possible. File recovery programs work by scanning the hard drive at a low level for headers and footers of files.

What it doesn't know (and can't know) is where that file sat in the file system. There is no "delete" flag - the easiest way to think of it is with the hard drive being a book and files being chapters.

The Operating System has deleted all references from the Index and Table of Contents, deleted the chapter title and ripped the pages out. So while the text still exists, you can't know what the chapter was called or where it was in the book.

Secondly, it's rule number 1 of data recovery that you never, ever, ever write to the drive you're recovering from.

link|improve this answer
Okay, thanks. But is it true that NTFS (like FAT) holds a second file table and if this is true, can i view/restore it to the master file table? – Erwinus Oct 28 '11 at 14:11
I never say never, but not my knowledge, no. – Dan Oct 28 '11 at 14:17
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.