Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Recently a virus attacked my PC and cleared 5% of my hard disk which has one partition. I viewed the disk in a hex viewer program like Active Undelete, cleared the virus data and overwrote it with 1s.

I want to recover a large file that is about 10GB, but no recovery tools seem to be able to recover any files.

In theory, is this file recoverable?

I think that files are fragmented; I've researched about the NTFS File System and I understand that cluster information is just saved in the MFT File?

Is there any way to recover files without an MFT structure?

share|improve this question

migrated from serverfault.com Nov 29 '11 at 15:04

This question came from our site for professional system and network administrators.

    
BTW: the NTFS filesystem stores a copy of the MFT (MFT mirror) in the middle of the volume. It probably is still there, good recovery software should be able to locate and make use of it. –  syneticon-dj Nov 29 '11 at 9:20
    
what filetype is this file? –  Journeyman Geek Nov 30 '11 at 0:38
add comment

2 Answers

A little knowledge is a dangerous thing. Lets see, the right thing to do would have been to get the data out before you did a seriously low level operation. The 'smart' workflow would be to get the data you needed out with a livecd, run a virus scan on it (or a few) then wiped the disk.

You want to use a livecd for recovery work, and a second drive to save files into. I'd suggest the xubuntu livecd, and you can install the tools i mention quite easily as needed.

I'd give testdisk (as mentioned by karlson) a try first, and if that fails, go for other alternatives.

Now, if its a common filetype (check it against this list) photorec ignores the filesystem and recovers files, so that it can work on extremely damaged filesystems. They have a step by step guide here. It does mangle filenames, so some digging may be needed to find the file (but in this case, the filesize should be a giveaway)

share|improve this answer
add comment

There are a few tools that can help with that:

  1. TestDisk -- I have used this previously; it worked great recovering from a broken NTFS partition. They have a step by step guide on using it which is very helpful.
  2. ForeMost -- also open source. Don't know much about this tool.
  3. Scalpel -- also a digital forensics tool.

If you are using Ubuntu at all they are all available in the repositories. You can check this link for more details.

Some of these tools state they are available in Windows versions, so if someone used those they can add some comments with regards to that.

share|improve this answer
    
Take a look at diskdigger.org for example –  woliveirajr Nov 29 '11 at 16:24
    
Could you perhaps edit your post to include the names/links for such tools? We prefer to add fuller answers and not just links to other sites. –  Simon Sheehan Nov 29 '11 at 20:22
    
added a guide to using testdisk –  Journeyman Geek Nov 30 '11 at 0:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.