It should be noted that DIY data recovery is almost always not advised. More often than not, DIY recovery attempts result in worsening the damage, and often results in unrecoverable data. The only exception to this are commercial data recovery software tools, including Ontrack EasyRecovery. However, if you would like to learn some basic data recovery techniques, you can become familiar with a hex editor.
Before reading any further though, you must be aware that using a hex editor to change file clusters could lead to permanent loss of data. Because of that risk, you should only proceed using a throwaway hard drive or USB flash drive. If you want to keep your data
We do not recommend trying to recover actual lost files yourself using these techniques as there are many, many other factors that can influence the recovery, including physical damage or the presence of multiple files. The intention of this blog post is purely for education.
If you are in any doubt at all, please download a free trial of Ontrack EasyRecovery, or get in touch with one of our data recovery consultants.
OK, with that out of the way, let’s begin.
If you are persistent to try to recover deleted files from your NTFS drive, you will need the following:
Connect the two drives to your PC, fire up your hex editor, and you’re ready to begin.
There are three steps to the data recovery process using hex editors:
It is important to note that not every file can be recovered. If the clusters containing your deleted files have been overwritten, you the data is almost certainly gone. This is why we always recommend ceasing to use a device with data loss immediately, as any activity after the data loss can cause these clusters to be overwritten.
Using the search function built into your hex editor, scan the drive for the name of the file that is no longer there. In this example, we’re looking for the PowerPoint presentation called “My Presentation.ppt” – the hex editor will return a string like this:
In the right-hand column, you can just make out the file name as M.y. .P.r.e.s.e.n.t.a.t.i.o.n…p.p.t.€
Among the many attributes returned by a disk search, is one called Flags, located 22 bytes into the File Record Header – it’s highlighted in red in the picture above. If the field is set to 1, the file is “in use”, or not deleted. In our example, the field is set to 0, which means that My Presentation.ppt has been deleted.
The search also returns values for the Cluster size, Compression Unit Size, Allocated size of the attribute, Real size of the attribute, and Data Runs attributes. Make a note of these values – you’ll need them for stage 2 of the recovery process.
Next, you need to rescan the drive, going through all the file clusters until you identify the file size that is equal to the selected clusters. The NTFS file system assigns each file a _DATA_ attribute that defines “data runs”, which in turn point to the location of the file clusters that need recovering.
Before proceeding, you will need to decrypt the data runs. Consider the following snippet from the hex editor:
This is where things become more complicated:
We know this is correct because the next byte is 0x00, indicating that no further data runs exist.
With the cluster chain identified, the last task is to copy the “deleted” data back to your other hard drive. Using the first cluster address identified in step 2 (312555), you then copy the 110 clusters that follow it – but first you need to calculate the offset of the first cluster.
You do this my multiplying the cluster size (512) by the First cluster address like so:
512 * 31255 = 160028160
This value then must convert into hex, giving you the offset that marks the start of your missing data = 0x0989D600
By copying the next 110 clusters (512*110 = 56320 bytes) to your second drive, you will have successfully recovered the “deleted” file from your NTFS partition.
Although possible, it is obvious that recovering data in this way is very time consuming, and can potentially cause further data loss. As previously mentioned, there are many combinations and permutations that can affect the success or failure of a data recovery. This post, again, is only intended for educational purposes.