Monday, June 11, 2012

Indexes in the NTFS

The term index is used to define an ordered list of files which are meeting certain criteria. The simplest and most common index is a group of files in a directory, sorted by name.

Thus, such indexing used in NTFS filesystem (storing copies of some attributes) can lead to great performance improvement since the number of disk read requests is decreased. For a regular operation, NTFS filesystem requires both Master File Table records and indexes. But it should be noted that to restore data from the NTFS file system, indexes are not required for MFT entries alone are sufficient. This is because exactly the same data as in index is contained in MFT records themselves. So it is not required to take into account indexes when extracting data from the NTFS filesystem.

But in case of chkdsk tool, it has to make sure that all the indexes are in a consistent state, otherwise NTFS filesystem is not able to work in a normal (fast) way. It is interesting that if chkdsk tool works on the disk which is copying data, then the tool may show false errors. This is due to MFT and indexes updates may be not synchronized.


Wednesday, January 25, 2012

Restoring digital image files from memory cards

It often happens that while doing the digital photo recovery, typically off an SD card, the small image previews (called thumbnails) are recovered OK, but full size images are damaged. This behavior is explained by so called "file fragmentation". The fragmentation is said to occur if the file is stored on the disk in multiple non-contiguous blocks. The sketch explaining the fragmentation can be seen at the Photo Recovery Limitations page.

In most cases memory cards use FAT or FAT32 and when the file is deleted on the FAT filesystem, only the information about the 1st fragment remains. The second and the following data blocks cannot be recovered. Thumbnail image is usually small and it is placed near to the very start of the file, hence it can be often extracted OK, while the high resolution photo will be lost.

Of all the data recovery types, fragmentation mostly affects digital photo recovery and unformat on FAT filesystems. Using the file recovery utilities in this case is almost always useless, for there is no needed data in the restored file.