NTFS disks

NTFS data recovery services for hard drives

CnW Recovery will recover data from corrupted, formatted and damaged disks

The NTFS disk operating system is both complex and much more error tolerant than the older MS-DOS based FAT system. CnW Recovery understands how NTFS disks operate, and so can recover files from all corrupted disks. This can include problems with deleted files, partitions, re-installation of operating systems and many other problems. See price guide for details on pricing. By using their own in house developed software, and new problems can be handled very quickly.

NTFS disk structure

As with a FAT disk, there is always a boot sector, but then the directory and file allocation is handled by a file called $MFT which is the Master File table. The space for this file is allocated when the disk is first formatted and is typically towards the middle of the disk. Thus looking for the table at the start of a disk is not relevant If the boot sector, or partition data is corrupted, CnW Recovery have tools to reinstate a new boot sector, or reconstruct the boot sector, also know as Master Boot Record MBR.

The MFT record structure is fairly complex and rather interestingly it is designed so that small files can be stored within the structure. Thus, although an MFT record is typically 1024 bytes long, and every file must have one, a small file of a few hundred bytes may be stored within it. On a FAT system, a single byte file will always take a full cluster of storage space, often 16K, plus a smaller directory entry of at least 32 characters (assuming a short file name).

NTFS does not have a FAT (File Allocation Table) but instead works with a series of pointers to say where a file starts and how long each sequential run of a file may be. For quickest access, a file should be sequential, but with long files, and and or a heavily used disk, it becomes necessary to store files in several fragments.  Obviously this can slow down reading, but it can also make recovery harder if the fragment information is lost.

With a FAT disk structure there is a limit of 4GB for a file size.  NTFS uses a 64 bit value for the file length- thus a maximum of about 16 Exabytes is possible. (An exabyte has 18 zeros!), or put another way, this is currently a file bigger than can be stored on a PC type system. The way that file data runs ins stored is very flexible, and can be expanded any number of times with an unlimited number of fragments and data runs. This can make recovery complex, but but also there is a good chance that the data runs will not be deleted from the disk and so a fragmented file can be reconstructed if required.

NTFS disks can be partitioned into many partitions.  The normal limit is 4 partitions that is normally adequate for 99% of users.  However, by using an Extended partitions, many more partitions can be added.  Currently, CnW Recovery has routines to handle up to 8 partitions, but this number could be increased as required.

NTFS disks can have software compression, for more technical details, click here NTFS Compression

For data recovery of a corrupted NTFS disk there are 4 basic approaches one can take.

  • For a disk that is basically sound, it can read in the normal way and errors taken care of when they are detected
  • The disk can be scanned and the old file indexes detected.  The files can then be read and some kind of directory structure reconstructed.  This approach can be taken when the root directory system has been destroyed.  We scan the whole hard disk for any residual MFT entries and so will detect old entries even when the disk has been reformatted.
  • Each MFT entry can be examined and the related file extracted.  Where possible the parent directory tree can be reconstructed.  This mode allows for corrupted directories, and also on disks where the partitions have been changed, or a completely new copy of the operating system has been loaded.
  • The raw disk can be read and files extracted based on file signatures.

Sometimes it may be necessary to use a mixture of all 4 methods depending on what data should be recovered from the disk and the extent of original disk failure. The NTFS structure has several built in features to aid data recovery, such a mirror copy of the most important MFTs, and also duplication partition descriptors.  Where possible these secondary sectors are used when the original is missing, or corrupted.

Any problem disks will be investigated by CnW Recovery free of any evaluation charge.


CnW Recovery Lewes  East Sussex  UK

[CnW Recovery] [Services] [Lost photos] [Technical notes] [Disk Image] [Erased DVD-RW] [DVD Recovery] [Lost Video disks] [GoPro Recovery] [Erased CD-RW] [Drive recovery] [Deleted files] [Zip disk drive] [Jaz Drive] [CD Recovery] [Forensics] [File dates] [UDF disks] [FAT Disks] [NTFS disks] [RAID Recovery] [Prevention] [ISO9660 disks] [MD5 hash] [File signatures] [Flash memory] [Boot sector] [Unallocated] [Raw recovery] [Encrypted Files] [File selection] [Mac Recovery] [NTFS reloaded] [Defrag progs] [Failed  chips] [3GP and MP4] [Formatted Video] [Price guide] [Online Payments] [FAQ Disks] [FAQ CD & DVD] [FAQ Memory] [Send Job] [Useful Links] [PC repairs] [Contact Us] [Site map] [About Us]