Can PhotoRec recover very small files from NTFS?

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
geeksalive
Posts: 3
Joined: 05 Mar 2013, 19:48

Can PhotoRec recover very small files from NTFS?

#1 Post by geeksalive »

Problem: It seems that PhotoRec doesn't recover small files from an NTFS partition.

I'm trying to recover a large number of "Favorites" (internet shortcut .url files) from a hard disk drive where they were apparently accidentally deleted. But I did a test run on my own hard disk drive, which has about 20,000 Favorites on it, searching the whole partition (not just the free space), and PhotoRec seems to find only the largest of the .url files. (Note: my .url files are larger than typical, because I use xmarks, which stores extra information in the .url files.)

Most .url files are less than 200 bytes, but the only .url files that PhotoRec found range from 455 to 1026 bytes!

My first thought was that compression might be causing the problem, but I checked, and my Favorites folder is not compressed.

So my theory, now, is that NTFS stores very small files in the MFT, rather than in their own data blocks, and PhotoRec cannot find such files. Does that sound right?

If so, then my guess is that there's no hope of recovering the lost .url files. Is that true?

Please tell me that I'm wrong!

Dave
Subject: recover MS Internet Shortcut .url files ONLY

When I run photorec_win.exe (PhotoRec 6.14-WIP, Data Recovery Utility, March 2013), and look through the list of available file-types, .url files are not listed by themselves:

Code: Select all

...
 [ ] txt  Other text files: txt,html,asp,bat,C,jsp,perl,php,py/emlx... scripts
 [ ] tz   Timezone info
 [ ] v2i  v2i backup
 [ ] vault McAfee Anti-Theft/FileVault
...
Instead, there is:

Code: Select all

[ ] tx?  Text files with header: rtf,xml,xhtml,mbox/imm,pm,ram,reg,sh,slk,stp,jad,url
Unfortunately, recovering all those file types finds a LOT of useless Internet temporary files, perhaps even too many to fit on the destination flash drive. How can I recover just the lost .url files using PhotoRec?

Right now I'm looking at running a "cleanup" script in another window, but there must be a better way:

Code: Select all

:top
sweep32 del /q *.h*
@REM -- ping is used to insert a 1 second delay
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.j*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.x*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.m*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.s*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.r*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.a*
ping -n 2 127.0.0.1 >nul
sweep32 del /q *.p*
ping -n 2 127.0.0.1 >nul
ping -n 2 127.0.0.1 >nul
ping -n 2 127.0.0.1 >nul
goto top
Dave

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Can PhotoRec recover very small files from NTFS?

#2 Post by cgrenier »

Small files and folders (typically, 900 bytes or smaller) are entirely contained within the file’s MFT record (source: http://technet.microsoft.com/en-us/libr ... 10%29.aspx ). Currently PhotoRec has no code to parse the MFT records to extract them.

geeksalive
Posts: 3
Joined: 05 Mar 2013, 19:48

Re: Can PhotoRec recover very small files from NTFS?

#3 Post by geeksalive »

Bummer. That's what I figured. (Though, oddly enough, NTFS must at least occasionally store files smaller than 900 bytes in their own data blocks, because PhotoRec did manage to find a few .url files which were 455 bytes or larger.)

Do you know of any other tools which can recover deleted small files from the MFT?

User avatar
cgrenier
Site Admin
Posts: 5432
Joined: 18 Feb 2012, 15:08
Location: Le Perreux Sur Marne, France
Contact:

Re: Can PhotoRec recover very small files from NTFS?

#4 Post by cgrenier »

no idea, sorry

Lito
Posts: 83
Joined: 08 Sep 2012, 06:58

Re: Can PhotoRec recover very small files from NTFS?

#5 Post by Lito »

Might be this site can help:

https://tzworks.net/prototype_page.php?proto_id=12

It is only an idea.

Best of luck

Locked