All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Data Recovery using MFT records
PostPosted: October 15th, 2010, 12:44 
Offline

Joined: October 15th, 2010, 9:03
Posts: 17
Location: Mississippi USA
This is my very first post ,I am planning to open data recovery shop and getting hands on training . May I know how to link MFT records to disk sectors to recover data.
If I got MFT records of a crashed disk ,how can I use them to recover data?
any suggestion will be appreciated. thank you all


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 15th, 2010, 12:51 
Offline
User avatar

Joined: February 27th, 2009, 3:26
Posts: 1721
Location: French Polynesia Tahiti
You will need to know and understand files systems and hex editors. Best advise learn this one and know it well and how to edit in hex and read hex. I would do a lot of learning and research before opening a DR center if you want to be sucessful and recover your clients data.

_________________
Iorana Haraharaini


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 15th, 2010, 12:55 
Offline

Joined: August 12th, 2008, 13:11
Posts: 3235
Location: USA
To paraphrase thatdellguy, I'm curious. What type of recovery operation are you going to run with no tools, no DR experience, no knowledge of filesystems, etc?

_________________
You don't have to backup all of your files, just the ones you want to keep.


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 15th, 2010, 13:28 
Offline

Joined: October 23rd, 2006, 8:56
Posts: 1336
Please be aware that such a thing as a decent hands on training program does not exist. Regardless of what you may have been told or read on the internet. There are some people that provide some expensive training that will teach you some fundamentals, this will put you somewhere at approx. 20% of the knowledge that you need to know in order to be successful in recovering data. The other 80% you will have to learn on your own by Research and Development, testing, spending lots of money on test equipment, other tools and lot's of creativity. Therefore please make sure that you have a sufficient understanding of the requirements to setup a successful DR shop. Not trying to discourage you, just trying to point out that it will be a long road.

As for MFT records, since your question is not very specific, there is no simple answer. As pointed out studding the NFTS file system in detail would be a good point to start. If your looking for a course, some of the advanced forensic classes go into details about the MFT.

good luck!


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 16th, 2010, 2:22 
Offline

Joined: October 15th, 2010, 9:03
Posts: 17
Location: Mississippi USA
thanks quasimodo
I got details of advanced DR courses by deepspar ,however you are right no one can teach you logic & fundamentals. I am very new and trasiting from hardware to DR. As such I am in no hurry & will support only my customers only.
I have been reading various articles and everyone stressed that , once you get MFT records ,you can analyse NTFS partitions in details. Commercial tools work fine ,but I am curious to learn manual recovery techniques.


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 16th, 2010, 4:49 
Offline
User avatar

Joined: August 19th, 2007, 17:30
Posts: 1899
Location: In your hard drive.
mark hazard wrote:
This is my very first post.

Welcome to the forum.


mark hazard wrote:
I am planning to open data recovery shop and getting hands on training.

That's the wrong order of events. You should learn the trade first then start your business. Thinking backwards is not a good way to start out. Many people get this mixed up.


mark hazard wrote:
May I know how to link MFT records to disk sectors to recover data.

No grasshopper. Crack open a book and read something.


mark hazard wrote:
If I got MFT records of a crashed disk, how can I use them to recover data?

Why are you asking us? If you're opening up a business for DR, don't you think you should know a little about DR first?


mark hazard wrote:
If I got MFT records of a crashed disk ,how can I use them to recover data?

Send those records along with the drive to someone that can use them.


mark hazard wrote:
Any suggestion will be appreciated. Thank you all.

Hey, glad to be of help.

:horse:

_________________
Buy your friends Toshiba\Hitachi and your enemies Seagate.


Top
 Profile  
 
 Post subject: Re: Data Recovery using MFT records
PostPosted: October 17th, 2010, 20:05 
Offline

Joined: October 15th, 2010, 9:03
Posts: 17
Location: Mississippi USA
Possibly only core professional will be able to understand my question properly. (those who write there own tools and have previously worked on manual data recovery process.)
From the pm's i received , among commercial tools Data Extractor has exactly what i am looking for.commercial software also do the same but internally working on root directory and fat tables.
I will start developing my own tools and more in depth study of file systems.
thank you all contributors


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 54 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group