data recovery, data recovery software, recover lost data, recover deleted data, restore lost data, free data recovery software
NTFS is a kind of new file systems, which is mainly promoted by Microsoft fast, and becomes the market mainstream on the basis of its reliability, security and efficiency. NTFS rarely produces fragments during using, and it strictly sets the user permission. Users can only perform operations according to gained permission, so any attempts beyond the authority will be forbidden. At the same time, its fault-tolerance log can record the users’ operations. However, all these features can’t prevent data loss caused by various causes during computer operating process. Among various data loss situations, accidental data deletion is the most common data loss situation. Here, I will tell you about the file deleting theory and recovery method under NTFS file system.
Firstly, let’s learn about NTFS data deleting theory.
NTFS use B-Tree file management methods to follow the file location on hard disk. B-tree uses the nodes of multiple branches to decrease the nodes which the system will go through when gaining records. Thus the system saves a lot of time. MFT consists of file record arrays, which records the index of each file on NTFS volume. Before visiting any files, we should firstly visit MFT. From this we know that to delete NTFS data, we don’t need to perform any operation on file data storage area, but just need to change MFT. So, is the operation in NTFS similar with the operations above? Actually, when deleting one piece of file in MTFS partition, the system makes three changes:
1. Make change on a node in the location where the MFT head of deleted file leans towards16H.
2. Change the INDEX_ROOT attribution (90H attribution) of parent folder or INDES_ALLOCATION attribution (A0H attribution).
3. Set the location where the corresponding location of cluster occupied by file in bitmap ($Bitmap) metadata file as zero, thus the space can be used to store other files.
From the NTFS file deleting theory we can see that when deleting NTFS file, the system doesn’t damage original file data. Now that the data is not damaged, we can successfully recover the data.
After knowing the file deleting theory, the file recovery should starts from the deleting theory. We can recover data through these steps:
1. Since the real file location is recorded by MFT, we must find MFT before recovering file.
2. After finding MFT, analyze the file record information in MFT, and find the INDEX-ROOT index root, INDEX-ALLOCATION index allocation and Bitmap to confirm and position of the deleted file. Thus we can find the file storage location in data area.
3. Modify the corresponding file data to recover data.
It is really heavy and difficult to recover file through methods above, and extremely professional data recovery knowledge is needed to recover deleted file. Is there any solution to recover deleted file by common users? Shall we have to turn to professional data recovery company? In fact, common computer users just need to use professional data recovery software to successfully recover deleted data. The professional data recovery software MiniTool Power Data Recovery is highly recommended, because it can help users who don’t know any data recovery knowledge recover file. Besides, it launches free home edition. At last, I must tell you that the data recovery software is not omnipotent because it also can’t recover data sometimes. So, the best way to prevent data loss is to back up important files.