I have worked with Microsoft file systems since DOS 3.3. From FAT12, to the current NTFS 5.0 Microsoft has always strived to make their file systems fast and reliable. However, there has always been one major drawback. Their file systems have always been too centralized. What I mean by that is when storing the file system on the hard drive it is always in one place. The FAT resides right after the OS Boot Record, The Master File Table in almost all cases resides at cluster 786432, or cluster 4. The OS Boot Record always seems to reside at sector 63. The MBR is always at sector 0 although this is an industry standard and not a Microsoft standard per-se.
With all this being said this kind of design can easily lead to the file system being corrupted. In other words if a sector goes bad, or gets overwritten, or the data becomes corrupt, the entire file system may become unusable. As an example, the FAT file system uses a centrally located File Allocation Table which maps every cluster on the hard drive to its appropriate file. With NTFS there is a Master File Table that is also centrally located that is even more susceptible to corruption and destruction.
In addition there are file system components such as an OS boot record that if corrupted or destroyed will give you the message “File System Not Found. Do you wish to format?” The Master Boot Record, INDX Records, File Entry Records etc. etc. These components when destroyed or corrupted will cripple your file system and ultimately make hard drive recovery impossible.
With that in mind there are two options that I have added to the NTFS flavor of the View It Now series of software to help view the file system even when some of the components are corrupt or missing completely. They are as follows.
Under the heading Volume Tools the option NTFS FS Functions is viewed under the drop down menu. Mousing over that function the following is revealed.
Build Virtual Volume
Clicking on the above function will display a dialog box that reveals three values for you to enter.
1. Sectors Per Cluster: Valid values for this field are 1, 2, 4, 8, 16, 32, 64, and 128.
2. Total Sectors: Valid value is from 1 to the total size of the river.
3. Volume Offset: Valid Value is from 0 to total sectors of the river.
Once you have entered the appropriate values for your partition just click on mount and the Volume will be displayed in the lower left hand list box of the main dialog box. This volume is now usuable for the following function.
Last Resort File System Build
This particular function does not depend on much of the file system being intact in order to tree the river. This fucntion takes a defined volume and scans it searching for valid MFT records. Once an MFT record has passed my filtering process it is added to a list of other records found. When the scan has finished or been interrupted by the end user a tree is formed and displayed just like any other river. This will then give you the chance to view the file names and see if in fact your file is there.
In addition, after the scan is completed and the records treed you can Export File List To Text File. That file can then be imported into a spread sheet to do searches and sorts on all the fields.
Download View It Now NTFS File System Viewer
If the hard drive is clicking or not seen by the BIOS, you will need hard drive recovery.