3

I have a bunch of files that were copied to an NTFS volume and then immediately deleted by accident. Nothing else has been done to the volume since. I have tried a bunch of different data recovery tools, and every single one has failed to recover every single file. They see all the files, but the recovered files are full of random gobbledigook. Is there any chance of recovery here? I'm curious about how every single tool I've tried fails in the same way -- is it possible that the latest version of NTFS has altered its structures somehow and the recovery tools don't know how to read it? Is there a particular tool that would be worth trying?

Tools I have tried:

I asked this question previously, and it was promptly closed as a duplicate with a reference to another question:

How do I recover lost/inaccessible data from my storage device?

However, that question doesn't address either of the questions I am asking here:

  • My disk is not failing. That question is all about disks that become inaccessible and may be suffering hardware failure.

  • My question is specifically about why a whole bunch of tools all think they restored my files but failed to restore a single one, immediately after the files were deleted. Has something changed about NTFS in Windows 10 that breaks the tools?

If you want to close this question as a duplicate, please make sure that it is a duplicate of a ticket that isn't about failing hard drives, that is about deleted files, and that is about recovery tools not working.

Jonathan Gilbert
  • 253
  • 2
  • 10

2 Answers2

0

Hard deletion is just writing zeros to the headers of files that will be deleted, so the filesystem wouldn't display deleted files, because true deletion would take a long time. And the filesystem will record the action. So the files immediately after deletion are still there; In fact, hard deletion just marks the deleted files safe to overwrite so when empty space is used up they would be overwritten.

You say

Nothing else has been done to the volume since

But that still leaves many questions unanswered: It is the volume empty or not empty before the copying? Is the volume internal or external? Have you installed any programs to the volume?......

Everyone of them would change the situation dramatically, there are just too many possibilities, you only said you didn't use the volume, yet it's unclear if the system or anyother program has accessed that volume. They may corrupt your deleted files.

But this is an answer, data recovery is scanning filesystem for deleted files and guessing their headers based on contents of deleted files(provided they haven't been overwritten); I would suggest you to try Wise Data Recovery, it's free and sometimes really works, if you used the other unprofessional softwares and they all see the files, it should be able to see them, too. But don't hold too much hope on it. It just scans recent filesystem records.

If it failes again, try this, it's the most professional tool I know of, unfortunately it isn't free(you have to buy professional version if you want to recover the files): DiskGenius; It scans whole disk for deleted files and can recover lost partitions and it really gets its job done most of the time, but not always;

If all else failed, try the ultimate file recovery tool:HxD, it is free and open source, it's a hexadecimal viewer and editor that can see the hexadecimal data of disks, if you are absolutely sure the files really are there, then the files must also be displayed by HxD, you should be able to guess their headers and manually recover them; Use it at your own risk, any wrong action can bust your filesystem, if that happens, run chkdsk /f X:(X means all partitions on the disk you modified) to fix the filesystem; Generally it's not recommended to use hex editors, but if you really want to use it, don't let the hex scare you, you will make sense of it in years...

Ξένη Γήινος
  • 3,902
  • 13
  • 45
  • 84
0

In NTFS upon deletion of a file the MFT entry (metadata information like name, creation date...) gets marked as deleted and the clusters used by the file are released.

If you delete files by accident you would need to immediately power down the drive because depending on write activity on this drive and the assignment strategy of windows or linux handling the NTFS file system it could happen that those clusters would be immediately reused, thus overwritten. Upon deletion of another file the clusters in question could be even released again making it appear as if they had been untouched.

r2d3
  • 4,050