What is NTFS File System Structure and How do I Undelete NTFS?

文件系统提供了一个结构化和组织佤邦y for file management capabilities like file naming, locating and access files. While formatting your hard disks, you can choose whether you want to use NTFS or FAT file system. Here I would like to provide a summarized insights of the NTFS file system.

NTFS file structure:The NTFS file system divides the useful space on the drive file system into clusters. The size of a cluster can be 512 bytes to 64KBs. In NTFS file system, the disk is divided into MFT space and space for file storage. The MFT part occupies around 12% of the disk to store the MFT metafile and rest 88% space is used for data storage. The MFT (Master File Table) file is stored within the MFT region and contains records of all other disk files. The first 16 metafiles in a MFT record are system files responsible for system operations. The Meta file names are prefixed by a ‘$’sign for example: $MFT, $Boot (boot sector), $LogFile (journaling support file), $.(root directory) etc.

Working of NTFS:While formatting the hard drive, correspondingMBR(master boot record) will be created. At the volume mount time, the MBR executes and boot the OS on file system for the stated volume.

Cluster is the smallest possible space for file storage. Generally the cluster size is 512 bytes, one sector in 512 byte. There could be 8 sectors in a 4 KB cluster. While system startup, the information stored within the clusters is retrieved to load the OS and locate the partitions.

Mounting a NTFS volume:

While mounting the NTFS volume, boot sector is initiated at first by MBR through executing a chunk of code (i.e.master boot code),磁盘签名和分区表。接下来,the boot sector mounts the Volume.

The master code controls following operations:

Locate the active partition from the partition table
Locate the starting sector for the active partition.
Load active partition boot sector copy to memory and initialize the executable code.
The boot sector then performs following sequence of activities:
The power-on self-test (POST)is started for the BIOS and CPU
BIOS locates the boot device and maps the boot device sector to a memory location. The CPU control is then transferred to that particular memory location

What happens when you format the drive?
While you format a drive, the NTFS file system structure is replaced and cluster size is changed as well the cluster data is erased so that they are set to align at the cluster size boundary. In case of quick format only, the file system structure is replaced and the sector integrity remains intact.
Once you have formatted the drive, the data will be lost and there is no way to get it back. So be cautious while performing any formatting, merging, partitioning or any other operation with the system drive.

If you have lost data form you NTFS drive, you need NTFS recovery tool for performing recovery of the lost data. The NTFS recovery programs are capable of retrieve back all deleted/lost files from NTFS drive on a Windows based system.

How to perform NTFS undelete:

Download and install the software from:
//www.photo-criticism.com/recover-windows-nt.htm
Launch the tool. Click ‘Drive Recovery’ option, it will list all your system volumes. Select your desired volume to be recovered and choose recovery action (i.e. quick, deleted, advanced or raw recovery) to be performed.
After completion of the scanning process the recoverable data will be shown in the preview pane. You can select items from the left pane and preview them in the window.
Select the desired items to be saved. Click Save.
Choose the destination location for the recovered data; you can choose a local server location or a FTP location.
Click OK
The data will be saved at the chosen location.

Along withNTFS data recovery, the tool also provides you additional feature for Cloning of NTFS Hard Disks, volume imaging and tool for monitoring the Hard Drive health status.