NTFS file system

[Bryanc512]

Hi, I recently had TWO 14TB hard drive get their directories/partitions messed up, not really sure how it happened, but it did. anyway, upon trying to recover/rebuild them, I've been through lots of different utilities (BTW, testdisk recovered one, then chkdsk /f fixed all the tiles, so much for the paid programs ) anyway, I started looking into the NTFS file system format, and it lead me to this question: Does anybody make, (or CAN anybody make) an 'addition' to NTFS that will make (live, as the system operates, with every change) a backup of the partition/directory/file information, possibly on a separate disk for just such an emergency? Then if there was some virus/bad sector/who knows what that messed the original up, maybe the backup would still be intact?

[Arch Stanton]

It's called a backup.

Even if you backed up for example MFT it would be invalid probably 10 seconds further. Restoring it would yield file system inconsistencies and you'd still need chkdsk to fix those.

[Arch Stanton]

I've been through lots of different utilities (BTW, testdisk recovered one, then chkdsk /f fixed all the tiles, so much for the paid programs )

From a data recovery perspective you should not run any tools that try fix anything in-place.

[Bryanc512]

It's called a backup.

Even if you backed up for example MFT it would be invalid probably 10 seconds further. Restoring it would yield file system inconsistencies and you'd still need chkdsk to fix those.

backups are nice, but there are situations where it's not really necessary. it's a lot of data, but it's all re-installable, redownloadable, etc. 28TB of backup just isn't really a worthy option. And, ok, lets say I DID have those 28TB backed up, 14TB takes 30 HOURS to restore, not to mention, how much time does it take to back it up?

Why would the MFT be invalid 10 seconds later if they system is writing both at the same time?

I know nothing about the NTFS file system, I'm just asking questions....

[Arch Stanton]

Why would the MFT be invalid 10 seconds later if they system is writing both at the same time?

A backup of the MFT could be invalid 10 secs later. Yes, sure partition tables no problem, these are more or less static normally. But do mirror a dynamic structure like MFT it seems to me it needs to be built-in to FS driver or implemented at low level. But yeah I suppose it can be done at that level. I don't know of anyone who does, which may be telling.

Then you need to ask yourself what exactly you're trying to solve. Your example, like a bad sector indicates or may indicate you have a more serious problem that you do not want to solve in-place. A virus; there may be viruses that affect the MFT but how many of those can you name? And what if virus payload isn't limited to MFT? And so aren't you trying to solve a non existing problem or develop a solution that isn't a solution? How do you decide what you mirror to your backup MFT and so how can you make certain you're not replicating errors to your backup? - Just asking questions ..

Who's writing what at the same time?

Why not store data on a file system that has this kind of functionality built-in, redundancy of fs structures etc.?

backups are nice, but there are situations where it's not really necessary. it's a lot of data, but it's all re-installable, redownloadable, etc. 28TB of backup just isn't really a worthy option. And, ok, lets say I DID have those 28TB backed up, 14TB takes 30 HOURS to restore, not to mention, how much time does it take to back it up?

I'm not even going to go there.

I know nothing about the NTFS file system, I'm just asking questions....

I'd put that time into finding an answer to the question why your file system corrupted to start with.

[drHDD]

You can make mft backup by any data recovery utility which work with NTFS (Winhex or r-studio as examples). It is possible to create special utility to backup mft but who will pay for that?

[terminator2]

You can make mft backup by any data recovery utility which work with NTFS (Winhex or r-studio as examples). It is possible to create special utility to backup mft but who will pay for that?

Is there anyway to view MFT's which are recovered using some software.
If possible then can we generate list of files /folders both present and deleted. Such report could be useful for updating customers.
Also is there any clue we can generate for corrupted /overwritten files.
My knowledge is so limited I might need automated tools for analysis as I can't work on hex level.

[Lardman]

If possible then can we generate list of files /folders both present and deleted. Such report could be useful for updating customers.
Also is there any clue we can generate for corrupted /overwritten files.

It would be worth your time spending a few days working with and learning DE, everything youre asking about can be done with maps / sub maps and reports. I think ufs explorer has also added a host of this type of functionality in the latest versions if you're using that.

[Arch Stanton]

You can make mft backup by any data recovery utility which work with NTFS (Winhex or r-studio as examples). It is possible to create special utility to backup mft but who will pay for that?

Is there anyway to view MFT's which are recovered using some software.

DMDE comes to mind.

If possible then can we generate list of files /folders both present and deleted. Such report could be useful for updating customers.

Several tools can do this. DMDE comes to mind.

Also is there any clue we can generate for corrupted /overwritten files.

What do you mean exactly? Overwritten data can not be regenerated magically.

Corrupt files are generally result of incorrect recovery, partial overwrites or media defects. Depending on cause and file type, some form of repair may be possible. In case they're result of incorrect recovery you need to do a better recovery rather than file repair.

My knowledge is so limited I might need automated tools for analysis as I can't work on hex level.

You could argue any logical recovery can be done using a hex/disk editor provided you have enough time, knowledge and you are mad. No one likes (AFAIK) dealing with hex based tools and this is why recovery software exists. At some point though viewing data in hex format can be useful. It's good to have some idea what data or what a disk structure should look like in hex. I repair files a lot, videos and photos, end first thing I'll do is open the file in HxD. Depending on what I see I can often tell in a split second that any attempt to repair is useless.

A tool like DMDE is IMO a nice and cheap way (you can use the free version for that even) to learn something about disk structures and what those look like in hex view.