cgsecurity.org

Problem: It seems that PhotoRec doesn't recover small files from an NTFS partition.

I'm trying to recover a large number of "Favorites" (internet shortcut .url files) from a hard disk drive where they were apparently accidentally deleted. But I did a test run on my own hard disk drive, which has about 20,000 Favorites on it, searching the whole partition (not just the free space), and PhotoRec seems to find only the largest of the .url files. (Note: my .url files are larger than typical, because I use xmarks, which stores extra information in the .url files.)

Most .url files are less than 200 bytes, but the only .url files that PhotoRec found range from 455 to 1026 bytes!

My first thought was that compression might be causing the problem, but I checked, and my Favorites folder is not compressed.

So my theory, now, is that NTFS stores very small files in the MFT, rather than in their own data blocks, and PhotoRec cannot find such files. Does that sound right?

If so, then my guess is that there's no hope of recovering the lost .url files. Is that true?

Please tell me that I'm wrong!

Dave

Subject: recover MS Internet Shortcut .url files ONLY

When I run photorec_win.exe (PhotoRec 6.14-WIP, Data Recovery Utility, March 2013), and look through the list of available file-types, .url files are not listed by themselves:

Code: Select all

...
 [ ] txt  Other text files: txt,html,asp,bat,C,jsp,perl,php,py/emlx... scripts
 [ ] tz   Timezone info
 [ ] v2i  v2i backup
 [ ] vault McAfee Anti-Theft/FileVault
...

Instead, there is:

Code: Select all

[ ] tx?  Text files with header: rtf,xml,xhtml,mbox/imm,pm,ram,reg,sh,slk,stp,jad,url

Unfortunately, recovering all those file types finds a LOT of useless Internet temporary files, perhaps even too many to fit on the destination flash drive. How can I recover just the lost .url files using PhotoRec?

Right now I'm looking at running a "cleanup" script in another window, but there must be a better way:

Code: Select all

:top
sweep32 del /q *.h*
@REM -- ping is used to insert a 1 second delay
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.j*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.x*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.m*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.s*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.r*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.a*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.p*
ping -n 2 127.0.0.1 >nul
ping -n 2 127.0.0.1 >nul
ping -n 2 127.0.0.1 >nul
goto top

Dave

Small files and folders (typically, 900 bytes or smaller) are entirely contained within the file’s MFT record (source: http://technet.microsoft.com/en-us/libr ... 10%29.aspx ). Currently PhotoRec has no code to parse the MFT records to extract them.

Bummer. That's what I figured. (Though, oddly enough, NTFS must at least occasionally store files smaller than 900 bytes in their own data blocks, because PhotoRec did manage to find a few .url files which were 455 bytes or larger.)

Do you know of any other tools which can recover deleted small files from the MFT?

no idea, sorry

Might be this site can help:

https://tzworks.net/prototype_page.php?proto_id=12

It is only an idea.

Best of luck