Novell NWFS and system markers

File recovery for Novell can be at best rewarding, at worst tedious, however, the file system and its components lends itself to a more robust data recovery theater.

One of the first things that are necessary is to make sure that the file system is in alignment and the system entries are intact.   For every NWFS partition you will find the following components.

 1. A beginning of partition marker         “Nw_PaRtItIon”.          Offset 0

2. A backup of the partition table.                                             Offset 1

3. First HotFix marker                          “HotFix00”                   Offset 32

4. First Mirror marker                           “Mirror00”                   Offset 33

5. Second HotFix marker                     “HotFix00”                   Offset 64

6. Second Mirror marker                      “Mirror00”                   Offset 65

7. Third HotFix marker                        “HotFix00”                   Offset 96

8. Third Mirror marker                         “Mirror00”                   Offset 97

9. Fourth HotFix marker                       “HotFix00”                   Offset 128

10. Fourth Mirror marker                     “Mirror00”                   Offset 129

11. Volume Definition Table                  “Netware Volumes”      Offset (32 + size of Hotfix)

 Using WinHex as your sector editor it is a simple task to see if these components are where they are supposed to be.  If they are then the next step is to find the Directory Entry Table (DET).   The DET is like a MFT for NTFS in as much as it holds the placement of every file in the system.  Unlike the MFT, there are multiple copies of the DET and therefore a higher chance of recovery exists.

NWFS is not used very much anymore.  Novell went to NSS in its 6.x series of OS, and NWFS went by the wayside.  It’s too bad since MWFS is fast, and easy to recover from.