Data Recovery for NTFS: File System for Windows

File Attributes

The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. Each attribute is identified by an attribute type code and, optionally, an attribute name.

System Files

NTFS includes several system files, all of which are hidden from view on the NTFS volume. A system file is one used by the file system to store its metadata and to implement the file system. System files are placed on the volume by the Format utility.

Recovering Data with NTFS

NTFS views each I/O operation that modifies a system file on the NTFS volume as a transaction, and manages each one as an integral unit. Once started, the transaction is either completed or, in the event of a disk failure, rolled back (such as when the NTFS volume is returned to the state it was in before the transaction was initiated).

To ensure that a transaction can be completed or rolled back, NTFS records the sub operations of a transaction in a log file before they are written to the disk. When a complete transaction is recorded in the log file, NTFS performs the sub operations of the transaction on the volume cache. After NTFS updates the cache, it commits the transaction by recording in the log file that the entire transaction is complete.

Once a transaction is committed, NTFS ensures that the entire transaction appears on the volume, even if the disk fails. During recovery operations, NTFS redoes each committed transaction found in the log file. Then NTFS locates the transactions in the log file that were not committed at the time of the system failure and undoes each transaction sub operation recorded in the log file. Incomplete modifications to the volume are prohibited.

NTFS uses the Log File service to log all redo and undo information for a transaction. NTFS uses the redo information to repeat the transaction. The undo information enables NTFS to undo transactions that are not complete or that have an error.

Hard Drive Data Recovery

The number one rule to follow when you have lost data is not to write anything more to the affected hard drive! This rule stands true for any situation.

If you have deleted a partition by accident, do not create another partition, just leave it blank.

If you have deleted files from the recycle bin that you realize you need, do not (if possible) save anything to the drive. The reason for this is that hard drives do not actually erase anything, not data or partitions. When you erase a file from the operating system, it is just marked on the drive as having been deleted. When the system needs to store more data on the drive, it will consider files on the drive marked 'deleted' as being empty space, and cheerfully copy over them. If that happens then you're in big trouble.

The same rule applies twice over for partitions; since partition information just presents the operating system with a way of addressing the space available on the drive. If you wipe out a partition everything from it will seem to be gone.

So if there is no partition information, no data can be read by the operating system. This does not mean that your data is not there however, only that you can't see it. Optimum Data Recovery provides you its services to recover data.

There are a variety of types of media failures and for each type of failure is a process for recovery. Data recovery is a very precise method. Failing to take the utmost care in your recovery can lead to a completely unrecoverable drive. There are a variety of software programs available that recover data. In many cases where your hard drive is not physically damaged, these tools can often be helpful. However, when dealing with physical damage to a hard drive, these tools can destroy any last hope of a successful recovery.

So, when do you need a Data Recovery Professional?

When recovery is critical and the data loss cannot be risked by using "do it yourself" recovery tools.
When noises are coming from the drive such as grinding, scratching, whining, crunching, etc.
When the drive does not power on.
When all other recovery options have failed.

In case of data loss, if you require Data Recovery, you should immediately stop using the damaged drive. It is imperative that it is not even turned on. Every moment the drive is powered can potentially cause critical damage making the drive unrecoverable.

For data recovery, visit www.optimumrecovery.com