Guide >> Concepts >> Understanding the File Recovery Process >> Disk scan for deleted entries

Disk scan for deleted entries

Example of scanning a folder on NTFS5 (Windows 2000):

Consider the following input parameters:

• Total Sectors 610406
• Cluster size 512 bytes
• One Sector per Cluster
• MFT starts from offset 0x4000, non-fragmented
• MFT record size 1024 bytes
• MFT Size 1968 records

Thus, we can iterate through all 1968 MFT records by starting from the absolute offset of 0x4000 on the volume and continue looking for deleted entries. MFT entry 57 having offset 0x4000 + 57 * 1024 = 74752 = 0x12400 is of interest because it contains the recently deleted file "My Presentation.ppt"

MFT record number 57 is displayed below:

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00012400   46 49 4C 45 2A 00 03 00  9C 74 21 03 00 00 00 00   FILE*...?t!.....
00012410   47 00 02 00 30 00 00 00  D8 01 00 00 00 04 00 00   G...0...O.......
00012420   00 00 00 00 00 00 00 00  05 00 03 00 00 00 00 00   ................
00012430   10 00 00 00 60 00 00 00  00 00 00 00 00 00 00 00   ....`...........
00012440   48 00 00 00 18 00 00 00  20 53 DD A3 18 F1 C1 01   H....... SY?.nA.
00012450   00 30 2B D8 48 E9 C0 01  C0 BF 20 A0 18 F1 C1 01   .0+OHeA.A?  .nA.
00012460   20 53 DD A3 18 F1 C1 01  20 00 00 00 00 00 00 00    SY?.nA. .......
00012470   00 00 00 00 00 00 00 00  00 00 00 00 02 01 00 00   ................
00012480   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
00012490   30 00 00 00 78 00 00 00  00 00 00 00 00 00 03 00   0...x...........
000124A0   5A 00 00 00 18 00 01 00  05 00 00 00 00 00 05 00   Z...............
000124B0   20 53 DD A3 18 F1 C1 01  20 53 DD A3 18 F1 C1 01    SY?.nA. SY?.nA.
000124C0   20 53 DD A3 18 F1 C1 01  20 53 DD A3 18 F1 C1 01    SY?.nA. SY?.nA.
000124D0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000124E0   20 00 00 00 00 00 00 00  0C 02 4D 00 59 00 50 00    .........M.Y.P.
000124F0   52 00 45 00 53 00 7E 00  31 00 2E 00 50 00 50 00   R.E.S.~.1...P.P.
00012500   54 00 69 00 6F 00 6E 00  30 00 00 00 80 00 00 00   T.i.o.n.0...^...
00012510   00 00 00 00 00 00 02 00  68 00 00 00 18 00 01 00   ........h.......
00012520   05 00 00 00 00 00 05 00  20 53 DD A3 18 F1 C1 01   ........ SY?.nA.
00012530   20 53 DD A3 18 F1 C1 01  20 53 DD A3 18 F1 C1 01    SY?.nA. SY?.nA.
00012540   20 53 DD A3 18 F1 C1 01  00 00 00 00 00 00 00 00    SY?.nA.........
00012550   00 00 00 00 00 00 00 00  20 00 00 00 00 00 00 00   ........ .......
00012560   13 01 4D 00 79 00 20 00  50 00 72 00 65 00 73 00   ..M.y. .P.r.e.s.
00012570   65 00 6E 00 74 00 61 00  74 00 69 00 6F 00 6E 00   e.n.t.a.t.i.o.n.
00012580   2E 00 70 00 70 00 74 00  80 00 00 00 48 00 00 00   ..p.p.t.^...H...
00012590   01 00 00 00 00 00 04 00  00 00 00 00 00 00 00 00   ................
000125A0   6D 00 00 00 00 00 00 00  40 00 00 00 00 00 00 00   m.......@.......
000125B0   00 DC 00 00 00 00 00 00  00 DC 00 00 00 00 00 00   .U.......U......
000125C0   00 DC 00 00 00 00 00 00  31 6E EB C4 04 00 00 00   .U......1neA....
000125D0   FF FF FF FF 82 79 47 11  00 00 00 00 00 00 00 00   yyyy,yG.........
000125E0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................
000125F0   00 00 00 00 00 00 00 00  00 00 00 00 00 00 03 00   ................
...............
00012600   00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00   ................

The MFT Record has pre-defined structure. It has a set of attributes defining any file of folder parameters.

The MFT Record begins with standard File Record Header (first bold section, offset 0x00):

• "FILE" identifier (4 bytes)
• Offset to update sequence (2 bytes)
• Size of update sequence (2 bytes)
• $LogFile Sequence Number (LSN) (8 bytes)
• Sequence Number (2 bytes)
• Reference Count (2 bytes)
• Offset to Update Sequence Array (2 bytes)
• Flags (2 bytes)
• Real size of the FILE record (4 bytes)
• Allocated size of the FILE record (4 bytes)
• File reference to the base FILE record (8 bytes)
• Next Attribute Id (2 bytes)

The most important information in this block is the file state: deleted or in-use. If the Flags field (in red) has bit 1 set, it indicates that file is in-use. In this example it is zero, i.e. file is deleted.

Starting at 0x48 is where the Standard Information Attribute begins (second bold section):

• File Creation Time (8 bytes)
• File Last Modification Time (8 bytes)
• File Last Modification Time for File Record (8 bytes)
• File Access Time for File Record (8 bytes)
• DOS File Permissions (4 bytes) 0x20 in our case Archive Attribute

Following the standard attribute header, the File Name Attribute belonging to DOS name space, the short file names, (third bold section, offset 0xA8) and again following the standard attribute header, the File Name Attribute belonging to Win32 name space, the long file names, (third bold section, offset 0x120):

• File Reference to the Parent Directory (8 bytes)
• File Modification Times (32 bytes)
• Allocated Size of the File (8 bytes)
• Real Size of the File (8 bytes)
• Flags (8 bytes)
• Length of File Name (1 byte)
• File Name Space (1 byte)
• File Name (Length of File Name * 2 bytes)

In this case, from this section, the file name, "My Presentation.ppt" can be extracted along with the File Creation and Modification times, as-well-as the Parent Directory Record number.

Starting at offset 0x188 is where non-resident Data attribute begins(green section).

• Attribute Type (4 bytes) (e.g. 0x80)
• Length including header (4 bytes)
• Non-resident flag (1 byte)
• Name length (1 byte)
• Offset to the Name (2 bytes)
• Flags (2 bytes)
• Attribute Id (2 bytes)
• Starting VCN (8 bytes)
• Last VCN (8 bytes)
• Offset to the Data Runs (2 bytes)
• Compression Unit Size (2 bytes)
• Padding (4 bytes)
• Allocated size of the attribute (8 bytes)
• Real size of the attribute (8 bytes)
• Initialized data size of the stream (8 bytes)
• Data Runs ...

This section reveals the Compression Unit size (zero meaning non-compressed), Allocated and Real size of attribute that is equal to the file size (0xDC00 = 56320 bytes), and Data Runs (see the next topic).

Learn More

Example of scanning folder on FAT16

Back << Contents >> Next

Active@ File Recovery © 1998-2008 Active@ Data Recovery Software. All rights reserved.