Thursday, December 24, 2015

NTFS Data Recovery - a very nice tool

I stumbled accross NTFS Data Recovery while trying to recover a PST file from MS Outlook. The file had been truncated to zero length after a system crash and I wanted to see if I could recover it. In the end, I didn't get the file back, mainly because I found a backup of the PST file and didn't need to it anymore; however, I must say that because of the generosity of LSoft Technologies Inc (http://www.file-recovery.com), which allows a free version to be dowloaded, I was able to learn a lot about file systems. In addition, the program came with some great reading material on how to recover files. In particular, a document  called "How to recover NTFS (Freeware Guide)", which can be found under the program's installed menu's item: "Documentation".

My use case was as follows:

Start Active@ File Recovery



Press the "Search" button in the menu bar's middle.


Enter the file format (*.pst), press "Find" and then navigate to the file using the explorer like view. From here, one can either inspect the MFT record or the raw data of the file.


When inspecting the file's data one should refer to Microsoft's documentation about PST files (Outlook Personal Folders (.pst) File Format). The formentioned document about file recovery contains some very helpful information about MFT records. 

Below, is the beginning of the raw data. Notice the marker "!BDN" at the beginning of the PST's header.



One thing, before starting your attemp to recover your lost file, I  would read the "How to recover NTFS (Freeware Guide)" first. There are some "Don'ts", like don't install any new software onto the same drive, you should read before starting.