A question to R-TT Team/NTFS experts about NTFS internals

A forum on data recovery using the professional data recovery software R-STUDIO.
artem

A question to R-TT Team/NTFS experts about NTFS internals

Post by artem » Mon Dec 21, 2009 6:20 pm

Hi!

Today I've been in a very bad situation - a friend of mine asked me to recover a folder (with over a hundred of files) which disappeared on its own, so I did a full drive scan using the latest R-Studio, and R-Studio hadn't found a single file out of that folder (I manually checked all deleted files on the drive).

The drive contains the only NTFS partition, which to my knowledge, has never been resized.

My question is:

Is it possible to intentionally delete a folder such a way, so that R-Studio won't find any traces of it or files which existed in that folder? Could that theoretically happen due to an unexpected power outage?

To my knowledge NTFS contains of two MFTs located in two different parts of a partition, so an application which concealed the traces of this misdeed should have altered both copies by writing to them directly, beyond win32 file unlink() API. Am I correct? Is it possible? Please, give me an insight on this issue.

Thank you,

Artem S. Tashkinov

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: A question to R-TT Team/NTFS experts about NTFS internals

Post by Alt » Tue Dec 22, 2009 4:43 am

I recommend you to search for those files all other the disk using the Find/Mark dialog box. Sometimes R-Studio may place files into the Extra Found Files folder if it finds a file only and not its parent folders.
About theory: Yes, it is possible to completely remove all traces of files and folders on an NTFS partition by using a special wiping software like R-Wipe & Clean. Quite unlikely that something like power outage can do that.

artem

Re: A question to R-TT Team/NTFS experts about NTFS internals

Post by artem » Tue Dec 22, 2009 5:33 am

Like I said I scanned all deleted files on the drive using Search -> Find All Deleted Files.

BTW, are you implying that R-Wipe & Clean can clean all MFT records? Is there any other possibly free software that can do that?

Alt
Site Moderator
Posts: 2271
Joined: Tue Nov 11, 2008 2:13 pm
Contact:

Re: A question to R-TT Team/NTFS experts about NTFS internals

Post by Alt » Tue Dec 22, 2009 6:52 am

Wipers are made to irrecoverably wipe files and clean their all respective records.
I can't recommend you anything particular, you may find them using Google.

Post Reply