0

In data recovery tools such as IsBuster, there is a list of deleted files on FAT file systems, which shows up instantly without any need for scan, even older file/directory names after renaming and complete filenames without ?ilename (missing first letter due to question mark) are common.

In NTFS, except the file header scan "find lost files and folders,** there is another option called "find deleted files and folders". Probably an equivalent to Recuva Quick scan. It requires a few seconds to a minute to scan the master file table, then it sanitises (not sure what it means) the data and shows a list of fully named files and folders.

In UDF on a DVD+RW and -RW, there is just a "lost-and-found"-area with orphaned files and directories, which does not require the full scan for lost data to finish, only the beginning. The directories contain files with visible names. It scans the first few thousands of LBAs in that case to find segments from the file structure. Of course, when allowing the scan to finish, on WORM discs DVD-R, DVD+R and CD-R, there are VAT builds. But on +RW, apparently, UDF reserves one sector for each link to a file, folder and sparse files if small enough to fit in the sector itself among metadata

What is the technical explaination that deleted FAT files can be listed instantly, without scanning, while NTFS requires a quick scan? File system structure?

  • 2
    Stretching back into the midsts of time (ie pre Pentium days), when a file was deleted on a (FAT) filesystem it simply changed the first character to a "?" (from memory) - thus the file still existed, and simply needed to have the first letter reinstated - This could be done with a hex editor or the undelete command - and doing so would use trivial amount of resources similar required to a file rename command. – davidgo Feb 17 '18 at 4:55

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.