A question to R-TT Team/NTFS experts about NTFS internals
Posted: Mon Dec 21, 2009 6:20 pm
Hi!
Today I've been in a very bad situation - a friend of mine asked me to recover a folder (with over a hundred of files) which disappeared on its own, so I did a full drive scan using the latest R-Studio, and R-Studio hadn't found a single file out of that folder (I manually checked all deleted files on the drive).
The drive contains the only NTFS partition, which to my knowledge, has never been resized.
My question is:
Is it possible to intentionally delete a folder such a way, so that R-Studio won't find any traces of it or files which existed in that folder? Could that theoretically happen due to an unexpected power outage?
To my knowledge NTFS contains of two MFTs located in two different parts of a partition, so an application which concealed the traces of this misdeed should have altered both copies by writing to them directly, beyond win32 file unlink() API. Am I correct? Is it possible? Please, give me an insight on this issue.
Thank you,
Artem S. Tashkinov
Today I've been in a very bad situation - a friend of mine asked me to recover a folder (with over a hundred of files) which disappeared on its own, so I did a full drive scan using the latest R-Studio, and R-Studio hadn't found a single file out of that folder (I manually checked all deleted files on the drive).
The drive contains the only NTFS partition, which to my knowledge, has never been resized.
My question is:
Is it possible to intentionally delete a folder such a way, so that R-Studio won't find any traces of it or files which existed in that folder? Could that theoretically happen due to an unexpected power outage?
To my knowledge NTFS contains of two MFTs located in two different parts of a partition, so an application which concealed the traces of this misdeed should have altered both copies by writing to them directly, beyond win32 file unlink() API. Am I correct? Is it possible? Please, give me an insight on this issue.
Thank you,
Artem S. Tashkinov