NTFS Deleted File Recovery (Windows, from a Disk Image)

About the NTFS Deleted File Recovery (Windows, from a Disk Image)

First make a disk image of the drive: one file that holds every sector of it, made with a disk-imaging program and kept on another drive with room for it (the Data Recovery Assistant shows the steps for Windows, macOS and Linux). Then open the image here. The page reads the drive’s NTFS file table (the $MFT) the way Microsoft documents its structures and lists the files that were deleted, with their names, folders, sizes and dates, and how likely each one is to be whole.

On NTFS a deleted file keeps its record in the file table until Windows needs the record for a new file, and that record still says exactly which clusters held the file, also when it was stored in many fragments. Files emptied from the Recycle Bin get their original names and folders back. Then each photo, video, PDF, ZIP archive and Office file (.docx, .xlsx, .pptx) found is checked by its own content (a photo is read to its end, a video’s index is read, an Office file is opened) and marked Opens fully, Partly damaged or Can’t be opened; kinds of file the page cannot check, such as plain text, are marked Not checked. Nothing is uploaded: the image is read on your device, a few megabytes at a time.

Common uses

• Getting back photos, videos and documents deleted from an external hard disk or a large USB drive used with Windows.
• Restoring files after the Recycle Bin was emptied, under their original names and folders.
• Rescuing the files of a drive Windows says needs formatting, when its file table can still be read (tick “Also list files that were not deleted”).
• Checking which deleted files are still whole before deciding what to save.

Why you need an image first

A web page cannot read a disk or USB drive sector by sector, and no browser setting changes that: the WebUSB standard does not let a page claim USB mass-storage devices, and the File System Access API gives pages files and folders, never raw devices. A disk image (a file with every sector of the drive, deleted areas included) is what recovery needs, and imaging is also the safe way to work: the drive is read once and never written to, and every later step works on the copy.

The image needs space on another drive at least as large as the drive itself: a 1 TB disk makes a 1 TB image. Large disks take hours to image.

How deleted files are found on NTFS

Every file and folder on an NTFS volume has a record in the master file table ($MFT), usually 1 KB long, with its names, times, size and data runs: the list of cluster ranges that hold its data. Deleting a file clears the record’s in-use flag and marks its clusters as available again, so, as Microsoft puts it, “the file data can still exist and be recovered” until something new is written there (Windows File Recovery). The record’s sequence number goes up by one when it is freed (FILE_RECORD_SEGMENT_HEADER), which lets the page tell a folder that was deleted from one whose record now belongs to something else.

The page reads every record, restores the two bytes at the end of each 512-byte stride from the record’s update sequence array (MULTI_SECTOR_HEADER), decodes the data runs (ATTRIBUTE_RECORD_HEADER), and rebuilds each file’s folders from the parent references in its names (FILE_NAME). Small files are stored inside their record and are read from it exactly. Files with very many fragments, whose runs continue in a second record, are joined in order.

What the conditions mean

• Opens fully: the file’s own structure checks out from its first byte to its last (a JPEG to its end marker, every PNG chunk checksum, a video’s index and data, every file inside a DOCX or ZIP).
• Partly damaged: it starts correctly, but part of it is missing or was written over; or some of its clusters now belong to other files.
• Can’t be opened: its first cluster now belongs to another file, so what is there is someone else’s data, or its data cannot be saved here (NTFS compression, EFS encryption).
• Not checked: a kind of file whose content the page cannot check (text files, for example). The note says whether another file uses its clusters now.

The volume’s cluster map ($Bitmap) says which clusters are in use today. When two deleted files claim the same clusters, the one that wrote last is taken to have written over the other, by the later of the time it was created on this drive and the time it was last modified (a copy is new on the drive but keeps the original’s modified time; an older file that grew later wrote its new clusters when it was modified).

Measured on test images

NIST’s CFReDS deleted-file-recovery test images include 24 NTFS volumes made with Windows, with NIST’s record of every file deleted from them and the sectors it used. On 20 of them NIST deleted 1,257 files to test recovery; 698 of those still had their record in the file table, and the page lists all 698 in their folders:

• 663 came back with every block in place (NIST tags each 512-byte block with its file and position): a file of 512 MB, files in up to five fragments, files stored inside their record, 260 files deleted from one folder, names in Devanagari, Arabic, Hebrew, Cyrillic, Korean, Japanese and Chinese characters, and one emptied from the Recycle Bin under its original path;
• 31 were marked as written over by later files, which they were, also where an older file had grown into the space of a newer one;
• 3 were marked as NTFS-compressed, which this page does not save;
• 1 had been written over by a file whose own record was later reused too: nothing on the volume records that, so the page listed it as whole.

The other 559 had lost their records to newer files, so the file table no longer says where their data was. Another image, dfr-14, tests links and extra streams: of its 15 deleted names, the page lists the 10 files they belonged to that are still in the file table (one file had two names), 8 of them whole and 2 symbolic links, which hold no data; extra data streams attached to a file are not listed, and two of the names had been removed from files that are still on the drive under another name. On the three images without deleted files the page lists nothing, and with “Also list files that were not deleted” ticked it lists every file, also 1,022 files in nine folders and folders nested nine deep. These images and checks are part of the page’s automated tests (as small extracts; for the 512 MB file, its sectors and its first and last blocks), together with volumes built in code (quick-formatted, Recycle Bin versions 1 and 2, damaged boot sectors, interrupted record writes, drives with 4 KB sectors).

Microsoft and Windows are trademarks of the Microsoft group of companies; MySmartCoPilot is not affiliated with Microsoft.

Limitations

• Works on disk images only, not on drives directly (browsers do not allow it). Raw images (.img, .dd, .bin, .raw, .iso), raw images saved in parts (.001, .002 …) and fixed-size VHD files open directly; E01, VHDX, dynamic VHD and other formats must be converted to raw first (the page says how).
• NTFS only. Memory cards and USB sticks formatted with FAT or exFAT are undeleted by SD Card & USB Drive Recovery; Mac and Linux drives, and NTFS files whose records were reused, by the deep scan, which finds photos, videos and documents by their content.
• Windows reuses the records of deleted files for new ones. A file whose record was reused has lost its name and the list of its clusters, so it is not listed here.
• A file written and deleted after another one may have used its clusters; when that file’s record was reused too, nothing on the volume records it. The content check catches this for photos, videos and documents, not for plain text.
• Data that has been written over cannot be recovered by any software. A full format (format /P), a secure erase, or TRIM on an SSD inside a computer leave nothing to find: for deleted files on internal SSDs, recovery is “almost always impossible” (R-Studio on SSD recovery).
• BitLocker volumes cannot be read without their key, and this page does not decrypt them. Unlock the drive in Windows, then image the unlocked volume (by its drive letter), not the physical disk, whose sectors stay encrypted; or run Windows File Recovery on the unlocked drive.
• Files that NTFS compressed (“Compress contents to save disk space”) or encrypted with EFS are listed but cannot be saved here.
• The search of the whole volume skips file records inside files the drive holds now, such as the virtual disk of a system image backup: their cluster numbers belong to that virtual disk, not to the drive. Copy or save the virtual disk itself and open it here as an image (a fixed-size .vhd opens directly; a .vhdx must be converted first).
• Extra data streams that NTFS lets programs attach to a file (alternate data streams, such as the mark Windows adds to downloaded files) are not listed: the file’s own content is. Symbolic links and other reparse points are listed with their names only, as they hold no data of their own.
• A web page cannot set a file’s date: files saved to a folder carry the day they were saved. The ZIP keeps the original dates, shown in this computer’s time zone.

Privacy

The image is read by your browser on your device, a few megabytes at a time, in background workers; no part of it or of the files in it is sent anywhere.