I don't have much to add. Usually NTFS is fairly straight forward, you have a numbered array of entries, most of these pointing to files/clusters allocated to files. Since it's cluster numbers / ranges pointed to there's few things a file recovery tool has to get right, being offset to cluster 0 and cluster size. And of course we need finding MFT entries themselves. Not just any, but chunks of MFT entries with ascending entry numbers that make sense in relation to a file system.
After full scan DMDE can show you all MFT chunks it found for selected volume, click All Found / Virtual FS > advanced TAB > Volume FS fragments. --/++ in previous TAB controls number of MFT entries included, so ++ all the way should show each and every MFT entry. Most likely this will include BS too, think for example virtual drive containers, or remains of a previous file system.
Quote:
Yes patient was cloned using hardware imager. Customers IT engineer might not tell actually what has happened as usual.
This may be your biggest issue. Context is key and context is often what we need to make some sense of what we see or do not see. As sort of a last resort I sometimes resort to simply scan the drive for possible partition starts and simply 'open' those to see what it gives, in case scenario was unknow, previous partitioning was unknown etc.. Some times you get lucky. Like this I mean:
https://youtu.be/5RClVfg-uOk
_________________
Joep -
http://www.disktuna.com - video & photo repair & recovery service