Page 1 of 1

A question to R-TT Team/NTFS experts about NTFS internals

Posted: Mon Dec 21, 2009 6:20 pm
by artem
Hi!

Today I've been in a very bad situation - a friend of mine asked me to recover a folder (with over a hundred of files) which disappeared on its own, so I did a full drive scan using the latest R-Studio, and R-Studio hadn't found a single file out of that folder (I manually checked all deleted files on the drive).

The drive contains the only NTFS partition, which to my knowledge, has never been resized.

My question is:

Is it possible to intentionally delete a folder such a way, so that R-Studio won't find any traces of it or files which existed in that folder? Could that theoretically happen due to an unexpected power outage?

To my knowledge NTFS contains of two MFTs located in two different parts of a partition, so an application which concealed the traces of this misdeed should have altered both copies by writing to them directly, beyond win32 file unlink() API. Am I correct? Is it possible? Please, give me an insight on this issue.

Thank you,

Artem S. Tashkinov

Re: A question to R-TT Team/NTFS experts about NTFS internals

Posted: Tue Dec 22, 2009 4:43 am
by Alt
I recommend you to search for those files all other the disk using the Find/Mark dialog box. Sometimes R-Studio may place files into the Extra Found Files folder if it finds a file only and not its parent folders.
About theory: Yes, it is possible to completely remove all traces of files and folders on an NTFS partition by using a special wiping software like R-Wipe & Clean. Quite unlikely that something like power outage can do that.

Re: A question to R-TT Team/NTFS experts about NTFS internals

Posted: Tue Dec 22, 2009 5:33 am
by artem
Like I said I scanned all deleted files on the drive using Search -> Find All Deleted Files.

BTW, are you implying that R-Wipe & Clean can clean all MFT records? Is there any other possibly free software that can do that?

Re: A question to R-TT Team/NTFS experts about NTFS internals

Posted: Tue Dec 22, 2009 6:52 am
by Alt
Wipers are made to irrecoverably wipe files and clean their all respective records.
I can't recommend you anything particular, you may find them using Google.