Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking for a solution to restore deleted files on a NTFS Volume. No new files are written to the disk so all files has the condition "Excellent". But i have no storage room to copy the deleted files to another volume. Is there a program that is able to simply unflag the delete state for a file or directory without the need to copy it? All programs that i have tried want to copy the files.

Thanks for your help.

Greetz, Erwinus

share|improve this question

closed as off topic by Sven, joeqwerty, Ward, rnxrx, Scott Pack Oct 7 '12 at 21:21

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

How about plugging in a USB drive? – joeqwerty Oct 28 '11 at 14:04
What do you think, if that was possible i will have done it – Erwinus Oct 28 '11 at 14:13
Well you didn't say it, so my assumption is to not assume that you've tried anything. – joeqwerty Oct 28 '11 at 14:59

My forensics is a bit rusty, but I don't think this is going to be possible. File recovery programs work by scanning the hard drive at a low level for headers and footers of files.

What it doesn't know (and can't know) is where that file sat in the file system. There is no "delete" flag - the easiest way to think of it is with the hard drive being a book and files being chapters.

The Operating System has deleted all references from the Index and Table of Contents, deleted the chapter title and ripped the pages out. So while the text still exists, you can't know what the chapter was called or where it was in the book.

Secondly, it's rule number 1 of data recovery that you never, ever, ever write to the drive you're recovering from.

share|improve this answer
Okay, thanks. But is it true that NTFS (like FAT) holds a second file table and if this is true, can i view/restore it to the master file table? – Erwinus Oct 28 '11 at 14:11
I never say never, but not my knowledge, no. – Dan Oct 28 '11 at 14:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.