List of files in hard drive?

[iman00b]

My HD failed and i lost about 10% of the files after recovery. Is there a list of files in a HD stored somewhere? Indexing service or something perhapse, since if i view the HD properties it still shows the full amount of space that was originally there.

 

[bob4432]

try the software "GetDataBack" for either Fat32 or NTFS

 

[Lord Evermore]

Technically yes, there's a list. It's called the File Allocation Table if you used FAT32, or the Master File Table if you used NTFS. It's not exactly a file you can just read though.

How are you seeing any files at all on the drive if it failed? If you performed a recovery of the data, then you've gotten every file that's going to be recoverable. If you're actually still using this drive, then you've probably overwritten any of the previous data anyway.

 

[iman00b]

Well, i made an image of the drive before i started anything. Ill have to look up more about the MFT. I know its there since windows tries to fix it and i saw it delete tons of entries that were corrupt in auto chkdsk B4 windows starts.

UPDATE: I extracted the MFT data from the image and now i just need to know how to pull file names from it. Anyone know?

 

[Lord Evermore]

If you're actually using the same hard drive, and by "recovery" all you mean is that you ran chkdsk on it, then you're already seeing every file that the MFT lists, just by looking at Windows Explorer or getting a directory listing at the command prompt. Once chkdsk has cleaned up corruption, the MFT no longer "knows" about any of the clusters that chkdsk might have deleted or changed, it only knows about the current files and where they are on the disk. If you don't see a file listed in Explorer, then the MFT isn't going to help you.

If there were in fact files that were "lost", then recovery software MIGHT be able to locate them, as long as they were not overwritten since then. However there's a good chance they were overwritten since you've continued using the drive. I've never tried the GetDataBack software, but there are many different applications available for recovering files, most cost money though some may have a free trial. But every moment you keep using the computer, you're increasing the likelihood of making those files unrecoverable. Those programs work by scanning the drive sector by sector and trying to figure out what looks like a file and what looks like junk, but if your system writes over one of your lost files, then the software can't recover it.

How do you know that you lost 10% of your files?

 

[iman00b]

I made an image of the drive onto another HD from starting to ending sectors. Then i went ahead and let windows try to repair the drive with chkdsk etc and so it found the MFT is corrupt and starts deleting files and recovering files into unkown directories. This is why i know the MFT has the file names etc from before. I also opened the MFT file and searched some files i know i had that are still listed in the MFT but its a very messy file thats hard to read. As for the 10%, i used recovery software to salvage what it could, then let windows do its repair.

 

[Lord Evermore]

Originally posted by: iman00b
I made an image of the drive onto another HD from starting to ending sectors. Then i went ahead and let windows try to repair the drive with chkdsk etc and so it found the MFT is corrupt and starts deleting files and recovering files into unkown directories. This is why i know the MFT has the file names etc from before. I also opened the MFT file and searched some files i know i had that are still listed in the MFT but its a very messy file thats hard to read. As for the 10%, i used recovery software to salvage what it could, then let windows do its repair.

Unless you did a bit for bit copy of the original drive to the other one, that other drive is going to be of little use to you. Programs like Ghost and others do not normally do an exact copy of the drive, they read the data according to the MFT and partition table and copy files using that. So you may have copied over the things like bad entries in the MFT, and lost clusters, but if a file was corrupted in the MFT and the data didn't get copied, then it's just lost.

If you have already used recovery software, then you've done as much as is possible without a very expensive recovery service company and the rest of your files are lost for good.

The MFT isn't just a text file, that's why it's "messy". The MFT not only stores the index to where files are located on the disk, it is used to store a small amount of each actual file, I think it's up to 4KB per file. Files smaller than 4KB get stored entirely in the MFT and nowhere else on the disk. If you open the MFT in a text reader, the reader is interpreting binary data and trying to display it as text.

 

[iman00b]

The image was just a backup incase something happened thats all and it proved to be of great value since it has an original copy of the MFT. The bad HD had its MFT edited since i went ahead and let windows do whatever it can about the bad sectors. All i wanted was a list of files that were in the HD to compare to what i recovered so i know what i lost. Which is the topic :] thx for pointing out the MFT... Now i just need a way to read / clean up the file. BTW do u know if zero fill format in maxtor tools = Low Level format?

 

[Lord Evermore]

It's what people call a low level format these days, yes. It wipes out all data on the drive.