I am looking for a Windows tool that tries to find & recover all
deleted files on a NTFS HDD.
Disclosure: I recover data for bread and butter. IOW it's my job. I wrote NTFS file recovery tools myself a while ago.
NTFS and undelete type recovery
File undelete from NTFS is actually pretty straight forward and any half decent undelete / file recovery tool should be able to do this. So, in general different tools will give very comparable results.
For undelete type file recovery from NTFS we need..
- MFT entry
- The actual data
.. to be intact.
If we don't have MFT entry, the file recovery or undelete tool can not detect the file. Without the actual data we can recover the file but it will be corrupt.
Once a file is deleted in NTFS, it's simply flagged in the MFT entry. Also, if the file isn't sent to the recycle bin, the clusters allocated to the file are flagged as not in use in the NTFS Bitmap.
This means the MFT entry can be re-used at any point in time, as well as the clusters. It may be so that ..
- the clusters are re-used while the MFT entry isn't -> file can be recovered but is corrupt.
- the MFT entry is re-used while the clusters aren't -> typical undelete software can not detect the file
- both are re-used -> the file is unrecoverable by any means
On a live, in use file system there's a good chance some component of the file we need to 'undelete' is overwritten and thus becomes unrecoverable. So, if the file is vital you need to prevent this from happening by taking the volume/drive off-line.
So, are all tools equal?
As I said, NTFS undelete is quite straight forward, we can scan the MFT and look for entries flagged 'not-in-use'. If a file is deleted the 'data-runs' aren't modified so it keeps pointing to all original clusters that were allocated to the file. Also, file entry points to parent folder, so IF we find the MFT entry we have everything to recover the file with original filename + parent folder(s).
A special case are the resident files: Small files that entirely fit into a NTFS file record (which is BTW 1024 bytes in size) as can be seen here:
Anyway, I am arguing any half decent file recovery tool should be able to recover actually recoverable files where we have both the MFT entry and the clusters that were allocated to the file. At the same time, any tool will have a problem if for example clusters that were allocated to the file were (partially) re-used.
Still, we see differences where tool A does arguably better than tool B, example here: https://youtu.be/IpbrQBgRdEs. In this example one tool is commercial software that's used by data recovery specialists for logical data recovery, while the other is free for personal use.
Drives that support TRIM
Since more and more drives support TRIM (SSD, SMMR drives) we can not ignore the effect on recovery of deleted files. As a rule of thumb recovery of deleted files from trimming drives is close to impossible.
We may be able to detect files (the MFT entries themselves aren't trimmed), but the data clusters are: https://youtu.be/NyLQbxnPurc.
Only tiny files that are resident and that entirely reside in the MFT entry may be recoverable.
In case deleted data is needed for for example a forensic case:
My software recommendation
I personally use DMDE on a daily basis. It may not be for the faint of heart but it allows me to see what's going on at the file system level.
If you only need to recover a few deleted files, you can use the free DMDE demo. The free demo allows:
- recovery of upto 4000 files per session. If you'd to recover more files, you have to re-open the drive.
- another limitation is that it will only allow you to select one folder, so all files you need to recover should reside in the same folder. If they're not you need to re-open the drive for each folder.
So, IOW, if you need to recover 1000 files you deleted from drive:\mypictures\vacation2022, the free version is all you need.
To make DMDE detect and display deleted files (or better said files flagged as deleted) see: https://youtu.be/sKpUiRDpLM8
- Select drive, click 'Open Volume'
- Click All Found / Virtual File System
- Select Pure FS and make sure 'deleted' is ticked
Other tools data recovery labs tend to use for logical file recovery are R-Studio and UFS Explorer.
This tool I made a while ago, but no longer maintain it. It lacks exFAT support and by no means I claim it's anything close to the best, but it's free and you're welcome to it: https://www.disktuna.com/fdrhelp/