Windows 7 Chkdsk searched my flash drive for bad sector recovery, and it deleted hundreds of my most important folder and files. unfortunately I have not any new backup from them.
The file system is NTFS.
Using R-studio Recovery tool, I found 112GB files from the 16GB flash drive with ~5GB used space. Recovered files doesn't include their path (and their names). between those recovered files, there are multiple copies of most of files and some previously deleted files are also found in there, some corrupted and some healthy.
I hope to find almost all lost files in there, but organizing these huge number of files, manually, without their name and path is not just pain, but it is also not possible.
Unfortunately there is not much of my lost files in the found.000, in the root of chkdsk-ed partition, just about 30 of them.
But when I looked at chkdsk log file, there seems that all of them recorded. Most interesting information in the log file, are entries from 3 types, example entries of first type of are such as:
Deleting orphan file record segment 20386.
and the numbers varies for each entry, sorted but they are not in a row.
second series of entries are in the format of:
The object id index entry in file 0x19 points to file 0x4bce but the file has no object id in it.
here also just the second hex number at the end of line one, changes in the series of the entries.
And the last series of entry, include names of files and folders and some index number and file hex address, example of them provided here:
Index entry Release of index $I30 in file 0x3b2a points to unused file 0x4bce. Deleting index entry Release in index $I30 of file 15146.
Release is the name one of lost folders, 15146 is the Decimal representation of 0x3b2a. Other entries include name of one file or folder. There is not matches for all of entries in part 2 and 3, but some of them matches like above examples.
Interestingly, the Recovery tool (R-Studio), named those recovered files to numbers in 3-5 digits, I was hopping that this numbers to match to the numbers in log entries, in somehow...
Points in the question:
- How could I recover deleted file entries after windows chkdsk in NTFS partition with their path(or atleast their name), using information provided in generated log file?
- Is there sufficient information to recover them? like NTFS journal or chkdsk log?
- I can and I'm ready to write an application for this purpose, if needed. but I don't know where should I start and what that program should do to recover the lost files.