Data Recovery Digest

A New Technology File System or NTFS partition works with Microsoft Windows technologies created within the last decade or so, starting with Windows 2000 versions. As NTFS replaced the previous File Allocation Table or FAT system, it became necessary to look at how all of the specific protocols for NTFS accommodate file and data recovery after formatting or other changes.

One common misconception or oversimplification about file recovery after an NTFS quick format is that while a full format would erase all data on the drive, a quick format would automatically save all data for easy recovery. The reality is that NTFS quick formats work in various ways, depending on the operating system in question and the volume of data that is being worked with.

The essential protocol for an NTFS quick format is the creation of a $MFT file in a fixed memory address. The Master File Table for NTFS is supposed to keep a record of the files in a volume. Specifically, the MFT is an index in which attributes of a file are recorded. The MFT operates on a fixed file record of 1kB and requires sufficient space in order to provide metadata on files. It’s important that techs understand both the makeup of that 1kB file and its use in order to know exactly what will happen after a format or other change to a partitioned drive.

One problem with the MFT model is that stored information may become fragmented. This can change the ways that users can defragment or optimize a space. A bigger issue, however, is that with a large number of files, the writing of MFT information to a fixed address may mean that some file information is written over and effectively lost. This is one reason why so many users report problems with recovery of data after a quick format with NTFS in Windows operating systems such as Windows XP, Windows Vista and Windows 7. Each of these operating systems will provide various default sizes for MFT caches, which will have a specific impact on the number of files that can be recovered.

For those users who go back and research the fixed address spaces offered under NTFS protocols, it would seem that some data may have been lost; however, in many cases it’s possible to locate lost files by their file signatures. Not all users, even those with some IT background, know how to do these kinds of recovery. Skilled data recovery experts can evaluate how to use an ‘extra search for known file’ type or other tool to find file information that doesn’t show up automatically after an NTFS quick format. It may also help to access specific Microsoft resources showing data allocation in $MFT file use, since this proprietary system involves the evolution of the MS operating system over time. By getting the details on file recovery in these environments, businesses can evaluate the use of a redundant system or other data safety solution to prevent unanticipated file recovery problems.