NO

Author Topic: Undelete files  (Read 13506 times)

JohnF

  • Guest
Undelete files
« on: April 11, 2005, 08:39:23 AM »
I converted a C++ app that undeletes files on NTFS drives - made a few corrections and alterations to the original code. The original loaded the whole MFT into ram, this could be a problem when the MFT has become very large. Apparently one guy had an MFT record of 1 gig.

So now the app loads chunks sequentially from the MFT record until all the records have been read. This works fine on drives formatted either with the Windows formatter or with 'Partition Magic' but it does not work with drives formatted with 'Acronis Disk Director'. For some reason the data becomes corrupt after loading a few records.

Apparently one must read blocks in multiples of cluster size, which is what I'm doing, but this still does not work for drives formatted with 'Acronis'.

Does anyone know anything about this?

The original way of loading the whole MFT into ram works even with drives formatted with 'Acronis'.

John

Anonymous

  • Guest
Problem with Acronis
« Reply #1 on: December 30, 2005, 06:58:03 AM »
I am unfamiliar with Acronis but the following is a solution that 'will' work.  Have you tried creating a 'stored' carbon copy of the MFT on the harddrive and loading chunks into memory and manipulating it instead so that you are loading chunks from a static copy?  This is not a perfect solution but it is workable.

Paul

JohnF

  • Guest
Re: Problem with Acronis
« Reply #2 on: December 30, 2005, 08:30:24 AM »
Quote from: "PBrennick"
I am unfamiliar with Acronis but the following is a solution that 'will' work.  Have you tried creating a 'stored' carbon copy of the MFT on the harddrive and loading chunks into memory and manipulating it instead so that you are loading chunks from a static copy?  This is not a perfect solution but it is workable.

Paul


Thanks for that advice.

John

hani118

  • Guest
Re: Undelete files
« Reply #3 on: January 13, 2015, 12:49:04 PM »
The original way of loading the whole MFT into ram works even with drives formatted with 'Acronis'.

Offline Bitbeisser

  • Global Moderator
  • Member
  • *****
  • Posts: 772
Re: Undelete files
« Reply #4 on: January 14, 2015, 02:32:37 AM »
The original way of loading the whole MFT into ram works even with drives formatted with 'Acronis'.
ICU!


Offline Vortex

  • Member
  • *
  • Posts: 797
    • http://www.vortex.masmcode.com
Re: Undelete files
« Reply #6 on: February 14, 2024, 10:21:16 PM »
DOS used to provide the undelete command, why M$ decided to remove it?
Code it... That's all...

Offline jj2007

  • Member
  • *
  • Posts: 536
Re: Undelete files
« Reply #7 on: February 15, 2024, 01:07:44 PM »
Good question. I got curious and made a little test:

Code: [Select]
include \masm32\MasmBasic\MasmBasic.inc
  Init
  ShEx "D:\$RECYCLE.BIN\S-1-5-21-2217455635-831285763-2584204927-1003\$R53967L.png"
EndOfCode

ShEx (ShellExecute...) works fine, I see the png.

Path copied by pressing Alt C in FreeCommander XE. Two problems:
- Windows Explorer doesn't show me the recycle bin.
- FreeCommander shows me the recycle bin, but the path I can copy is much different from the original. However, there is a column "original path"...

So I can restore a deleted file, but it's rather manual ;D

Offline TimoVJL

  • Global Moderator
  • Member
  • *****
  • Posts: 2091
Re: Undelete files
« Reply #8 on: February 15, 2024, 06:12:10 PM »
May the source be with you