How do I recover data from a NTFS file system

NTFS stands for New Technologies File System. It is a file system architecture developed by Microsoft in order to overcome the limitations of the FAT file system. Its first version was released in 1993, and it is being used by Microsoft since the release of Windows XP.

How Does The NTFS Work?

There is little support for this file system, because Microsoft has kept it as a trade secret. As a consequence, there are no official published specifications. However, there are several detailed unofficial descriptions, and support for Unix / Linux versions.

ntfs file system

It is a sophisticated architecture, designed for reliability, security and scalability. Today it is the most common file system for end-user computers.

The NTFS is a journaling system, where file changes are logged. Its main component is the Master File Table (MFT), which stores the necessary information to retrieve files from the partition. The file system also includes a copy of this table that can be used in case there is a problem with the original one.

The main parameters included in the MFT are the file name and the directory where the file belongs to. In addition, it stores the file’s physical location, size, permissions, and four time stamps: creation, modification, last access and last MFT record update. It also contains an index with the sections composing the file.

The first 16 entries in the MFT are reserved for some special records, such as the $BitMap, the $Log and the $BadClus. The $BitMap keeps track of all used and unused clusters. The $Log is used for journaling, and the $BadClus records all damaged clusters.

The NTFS has two interesting characteristics, which affect the way files are deleted. First, cluster size depends on volume size. Thus, for example, for volumes ranging from 513 MB to 1024 MB, the cluster size is 1 KB; and for volumes ranging from 1025 MB to 2 GB, the cluster size is 2 KB. Second, the contents of small files, called resident, are kept in the index.

How Do I Recover My Lost Data?

Deletion of a file in the NTFS means marking the storage space as unused. The actual data is not deleted, unless overwritten by the addition of another file. Therefore, it is recoverable. Lost files can be retrieved with a NTFS data recovery software such as Disk Drill.

Disk Drill data recovery app

Disk Drill
Data recovery for free
Your Companion for Deleted Files Recovery

How Do I Recover My Lost Data With Disk Drill?

Disk Drill is a commercial application used to recover lost data. There is also a free download version. The software is available for Windows and Mac computers. There are two scan options available:

  1. Quick Scan
  2. Deep Scan

Quick scan is useful after situations such a recent file deletion. Deep scan can recover older deletions.

The search can be narrowed through the Preferences option in the main menu, which limits the data retrieved to the selected file types.

The results are presented with the help of a menu that filters them according to file type (video, pictures, documents, audio, archives). It also includes the option of adding an extra filter by time or size.

Moreover, the application has also the options to pause the data retrieval, and to save the session and continue later, without losing the work already done.

How Do I Prevent Data Loss?

Disk Drill presents several options for data loss prevention:

  1. Recovery Vault
  2. Image back up file

The Recovery Vault is a technology that adds an extra layer to the Recycle Bin. If this option is on, after being deleted, a copy of the file’s metadata is kept in the Recovery Vault. In this manner, if the file has been deleted, and the Recycle Bin emptied, this application provides an extra alternative for NTFS data recovery. It works as a background service.

In addition, this software, through the Extras menu option, can help in creating a back-up image file.

Arthur Cole


Read full bio →