Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I somehow managed to delete the root directory in a NTFS volume (I know... don't ask).

Using ntfsundelete on Linux I can find a lot of inodes I can recover 100%. The problem is that I end up with 15,000 files named inode.xxx.

But I've just realized that most of these files were not in the root directory, but in a subfolder. And somewhere in the disk there's a directory structure that maps filenames to inodes. Since it wasn't the root, I'm assuming the table is still there? Or is everything stored in the MFT?

If I could somehow get the directory structure as a file, I can write a parser that will give me back the mapping between filenames and inodes. The question is, does this work in NTFS? I haven't done low level filesystem manipulation since FAT, where I know this would work, but no idea in NTFS.

Thanks!

share|improve this question
1  
It would help an awful lot to know what you did to cause the damage. –  David Schwartz Mar 1 at 10:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.