Just curious, when you use an imager like the deepspar and tell it to scan the $MFT how does it identify those sectors? I am not sure if this is a dumb question, but I will ask anyways.

because it is a known structure
basically it has smarts to analyse bytes and compare to the known structure

Read up on how the news file system works.

_________________
Luke
Recovery Force Data Recovery

news or ntfs?

If you tell the imager to scan the $MFT, does it start at the beginning of the drive and work through it one sector at a time checking to see if the sector contains $MFT data, if so then images it? That thought must be flawed, if it has to read every sector it may as well just image the whole drive. Does that mean it just partially reads the sector, enough of it to determine if it is part of the $MFT, then if so it will image the whole sector.