±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36779
New Yesterday: 2 Visitors: 121

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

HELP NEEDED and certainly appreciated

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

gmarshall139
Senior Member
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 17, 05 21:12

forget about the $mft, you don't need to do anything with it.

if you can recover the files copy them out to another folder and try to view them.
_________________
Greg Marshall, EnCE 
 
  

GeVeZe
Newbie
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 17, 05 21:21

manualy i can recover only 1percent of drive

i cannot understand one thing

i will recover the $MFt which is 101MB on my drive
this is ok

but then i will put on allocated drive of that drive

its is the same thing!!?

i am taking one file and putting same file to same place?!!!  
 
  

gmarshall139
Senior Member
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 18, 05 03:22

I'm not sure I completely understand your problem. Originally you stated that scan disk deleted a few files. Now it sounds as if you are saying that the entire partition is gone. There's more to rebuilding a partition than just recovering the $mft file. There are products out there that can help you recover partitions.

If the data is at all important I would suggest that you get someone who is qualified to do it for you. It is a very simple process to rebuild a partition if you have the proper tools and knowledge. The chances of you overwriting something and making the partition recovery impossible are fairly high, especially if you are working on the original.
_________________
Greg Marshall, EnCE 
 
  

GeVeZe
Newbie
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 18, 05 06:30

no partition is ok

only 40 Gb of 186GB is deleted and i recovered them with a active undelete

but also aprox 100GB of data has cannot open. I see the data is there. It takes 700MB disk space but still cannot open.

i see MFT recored and i remember scandisk is deleted some numeric files like MFT records. I guess i understand problem well

forget about mpg and jpg files but some txt files MUST to open

as you said i download winhex and cracked it. then using -right click recover- taked a copy of $MFT to a healty partition.

after this?  
 
  

gmarshall139
Senior Member
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 18, 05 14:32

If the partition is ok, and you have at least part of your data available, then you must have a functional $mft file. As I said before, you have apparently lost part of your $mft. What you are recovering is only part of the MFT. Putting it in another partition will not do any good. Your text files, if they are very small (under 1kb) would be resident data, they would exist entirely within the master file table.

I wouldn't advise you to try to put the recovered $mft back on the original partition. You may overwrite your healthy mft and loose everything. If you can make a copy then try it on that. I would suggest that you search for and try to recover the files that are important to you.
_________________
Greg Marshall, EnCE 
 
  

GeVeZe
Newbie
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 18, 05 19:25

there is no way to take a image of disk
because its 200GB

only 20GB of data accessible. so taked copy.

how can i merge deleted $mft files into $mft. 200GB has only one partiton.

i remember scandisk is deleted files like 786444,786445 .........

now i see some of my files deleted and moved to found.000 (files aprox 43GB).
meybe deleted $mft's is can there???  
 
  

gmarshall139
Senior Member
 

Re: HELP NEEDED and certainly appreciated

Post Posted: Jan 18, 05 20:40

Unless your very familiar with the mft I don't think you can merge them back together, I'm not aware of any product that will do that either. Even if you were it would be very difficult. As the $mft file grows it becomes fragmented. Embedded within the $MFT is the location on the disk of the continuing extents for the MFT file. It may well be this portion of the MFT file that was damaged, so now it doesn't know where to look for the remainder. You would have to get into the good portion of the MFT file with a hex editor and change or add the pointers to the sector that the recovered mft extent now resides on. It is way beyond what I can describe here. And understand I am only speaking about what is theoretically possible, I have never personally attempted it. You may try searching the microsoft knowledge base. It has probably come up before. Because of all this I restate my suggestion that you focus on recovering the files themselves that are important, rather than rebuilding the mft.
_________________
Greg Marshall, EnCE 
 

Page 2 of 3
Page Previous  1, 2, 3  Next