Thirty years ago the Internet was a fledgling set of 2400 baud modems and the communications monster Compuserve.  Compuserve had ‘Mega Wars’ and a small library of source code that could help a programmer.  However if an indie developer wanted to use the full power of a PC it was the book store and the myriad of technical masterpieces that would enable me to turn a PC into a computing dynamo. One of the first books I purchased and still have to this day was ‘The Programmer’s PC Sourcebook’.  This book had every BIOS interrupt and all the different flavors of the interrupt.  It had thorough descriptions of the DOS interrupt architecture and how it could be accessed and in many cases used to adapt the operating system to your own design.  The book is a marvel and there were many a time that I would just sit and thumb through its pages reading it like a good fiction.  Times were simpler then, you had to understand the hardware, the underpinnings of the operating system, and the ins and outs of how it all worked together, but it was much cleaner back then.  When you programmed on the wires there was an almost reverent symbiosis between the coder and the platform.  It’s hard to describe but I miss those days.  I suppose I am a purist at heart.

Anyway, I digress.  This book, ‘The Programmer’s PC Sourcebook’, other than being one of the best technical reference manuals in print was one other thing. It was HUGE!  I don’t mean it had a lot of pages, which it did, but the size of the book is like 18″ x 14″. It wouldn’t fit on a normal book shelf; I had to leave it on my desk all the time! It was also a paperback that I used daily for years. All of that being said what does that lead to?  Eventually, the book started to fall apart. Pages would fall out, and soon it was just a stack of pages on my desk.  After awhile I lost the index to the entire book and that made using it almost impossible.  If I had to look up something I would have to thumb through the entire book and try to find the information.  After awhile I started my own index which I kept on the side for the most used sets of information.  If I had only made a copy of the index on some copying machine I could have used the book more, but I didn’t and mores the pity.

After my sad book story, I suppose you are now scratching your head wondering, how does this have anything to do with data recovery from NTFS.  Well, you can stop scratching your head because here is the explanation.

A file system, any file system, is broken up into two categories, the index, and the data.  A file system is no different than a database.  A file system is no different than a reference book and its index. You have the data, and you have an index. In the NTFS file system you have the data which is stored in clusters, and you have an index called the Master File Table (MFT).  With this being the case, what if there was a way to save the index (MFT) in case something happened to it?  ‘What could possibly happen to my index (MFT)?  You could accidentally format your hard drive; people do it all the time.  A full restore could be done from either your restore cd or from the restore partition on your DELL, or HP, or whoever else has a restore facility and wipe out your entire file system.  Bad sectors could develop in your index (MFT) and the file system can become corrupt.  A virus can destroy an entire index (MFT) in the blink of an eye.  There are other ways but I am sure you get the picture. With all of these chances of your index (MFT) being destroyed isn’t it prudent to save your index?  I should have made a copy of the index to my favorite technical manual before I lost it.  Shouldn’t there be a way to save your NTFS file system index (MFT)?  Well there is.

I have developed a piece of software that will take your index (MFT) and save it to our servers in Florida.  It is extremely easy to use and allows you to save one (1) volume index onto our servers.  In the event that you run into a catastrophic situation and lose your index, you may have a chance of recovering a large portion of your data if you have saved your index to our servers.

A word of caution.  This is NOT a backup program; this is a way to backup the index of your NTFS file system.  Just like a book, if I backup the index of a book using a copy machine, but the book is destroyed in a fire, the copied index of the book does me no good.  However, if I make a copy of the index of my book, and lose the index, I can use the backup index to look up my data.  Finally, when you save new data to your file system the MFT is updated and changed to reflect the new data on your drive.  In the same manner an index from an older version of a book will not work on a newer version of the book.  So, if you save a lot of new data to your hard drive, it would be a good idea to backup your index again.  Once again, this is not a backup program, just a way to backup your MFT.

This may not be the total answer, but it is another option in the war to keep our data safe.  The more chances you give yourself for recovering your data, the better off you will be. Remember, it is not if it will happen to you, but when…

Download MFT Save Here

For more information about MFT Save Remote Restore Point for NTFS

For 1 month only, DTI Data Recovery is opening this course up to the public. We are offering only 4 online data recovery courses in 2009. Each course will include our full version data recovery software we sell, but also tools that only our engineers use. You will be able to recover everything from lost emails to deleted pictures, data lost from partition corruption and viruses as well as the following:

• Calculating and fixing a partition record for single and multipe partitions
• Restoring a deleted file by hand in FAT32
• Restoring a deleted file by hand in NTFS
• Determining the drive order of a RAID 5
• Restoring a file system using the backup OS Boot Records (NTFS and FAT32)
• Rebuilding a EXTFS2/3 file system using the super block
• Mounting the XFS file system from a NAS device in Linux
• Recovering JPEG files using a file harvesting technique
• Recovering MP3 files using a file harvesting technique
• Recovering a PST file using file harvesting, unused cluster map and scanpst
• Restoring the MFT from the backup
• Reading the block map for an EXTFS2/3 file system.
• Determining Block size of a RAID 5
• Determining RAID data set for a Simpletech NAS device
• Novell NWFS file system
• Microsoft Access Database file format and recovery
• How to configure a Knoppix disk
• How to configure a Bart PE disk
• Recovering data from a DBX file
• Swapping USB Enclosures

The course is discounted from its original price of $2500.00 to $995.00 and will not be held again this year.

Reserve your class now, before it is too late, only 10 members per class!
Call 866-418-3843 or fill out Online Data Recovery Training Sign Up Form

Learn more about online data recovery training here.

If you have a data loss situation where your hard drive is clicking, or is not seen by the BIOS, you will need traditional hard drive recovery. All other situations can be recovered remotely by our trained technicians. Most remote hard drive recoveries are less than $100 and we only charge if the recovery works.

The fact that DTI can put your computer back to where it was before the problem without data loss, is a completely new technique of hard drive recovery. Call 727-345-9665 for more information!

Windows Blue Screen of Death

If you have turned your PC on and received this message the problem can be solved with the following steps. However, before beginning, it is very important to note that the cause of the problem may be the hard drive itself. As with any type of do it yourself recovery this could cause permanent unrecoverable damage to the hard drive and or the data that exist on the hard drive. Like most hard drive recovery processes, physical disk repair isn’t necessary if the hard drive is seen by the BIOS. If your hard drive is recognized by the BIOS, but you get the blue screen of death these steps will help you restore Windows. Be careful and backup if you can! That said, lets continue.

If you have your hard drive manufacturers diagnostic tools, please read the documentation carefully and test the drive to make sure it is functioning properly. If you do not have the manufacturers diagnostic tools you can go to their respective websites to download them. It is important to read the documentation as these tools may perform data destructive tests and procedures to your hard drive. It is also a good idea to try and recover some of the data by making your boot drive a slave drive under another Windows system for hard drive recovery. Please see our previous post “How to slave a hard drive“. Ok, lets proceed with the restoration and hard drive recovery.

Windows Command Prompt

Time for the XP Recovery Console.

You are going to need to get your XP Installation Disk.

You will also need to make sure you can boot from your XP installation Disk. Insert you installation disk in your cd/dvd drive and make sure you see the option press any key to boot from cd: If so, do so and you’re good to go. If you do not see that option you will need to enter your system setup (BIOS) and change the boot order. When your computer boots you should see press delete, F10 or some key function to enter your systems setup. You will usually find the boot order under advanced settings once you are in the setup console. Simply select boot order and choose CD as your first boot device. You may change the boot order back to the original settings after this exercise in hard drive recovery.

When you boot to your Install CD it will take a minute to load all the drivers, then it will provide two options-Setup or Recovery Console; “press r” for the recovery console. It will than ask you which Windows install you want to repair, most users will only have one so just input 1 and press enter. You should now have entered the recovery console of your Windows XP CD.

What you are about to do is basically a minor System Restore via the Recovery Console. We are going to use an older version of the currently curr The text in red will be what you should type and the black text will what the system outputs. READY, SET, GO.

C:\Windows>CD C:\system~1\_resto~1

C:\system~1\_resto~1\>dir

After you enter the DIR command and hit enter you will get a list of folders like rp1, rp2, rp3, rp4, etc.. The “rp” part of the folder name indicates it’s a Restore Point.

What we want to do is use the 2nd or 3^rdhighest numbered folder in that list. For example, if it listed rp1 through rp53 you’ll want the rp52 folder. We will use rp52 to outline the rest of the procedure.

Now, we will use the following commands..

C:\system~1\_resto~1>cd rp52

C:\system~1\_resto~1\rp52>cd snapshot

C:\system~1\_resto~1\rp52\snapshot>copy _registry_machine_system c:\windows\system32\config\system

Overwrite system [y,n]: y

1 file copied

C:\system~1\_resto~1\rp23\snapshot>exit

Remove the installation disk .

Those are the steps to restore Windows after getting The Blue Screen Of Death. If you need help give us a call at 866-418-3843 or visit hard drive recovery.

The first thing you need to do is make a directory on your machine that contains Recover It All. After that you need to hit the Bart PE website and download their latest version, and install it.

Data Recovery and Bart PE

Note: This installation was done on a computer that has 2 CD drives. This is a optimal way to make the CD, but if you can’t do that then make a directory and copy your windows CD into it.

When you start Bart PE you will get a screen asking you if you would like to search for your windows files, make sure you have your Windows CD in the drive and let it do its search. After the search is done you should be able to select your Windows CD as the place where you windows files exists.

After the scan is done you will need to click the little next to the Custom: field so that you can browse to the Recover It All Directory. After this is done make sure you tell it to Burn to CD/DVD and that you have a writable CD in the other CD ROM drive. Then tell it to Build.

It will open up a new screen and begin to make the file and CD.

Once this has finished you now boot from your Bart PE CD. Once in Bart, you will have the ability to browse to the Recover It All directory and run the software on the hard drive needing data recovery.

Disclaimer: Microsoft does not support Bart PE, and therefore should not be called to lend a hand in the creation of the CD. DTIData, also does not support Bart PE, this article is purely for informational purposes.

The most popular of these seem to be Dell’s PC Restore by Symantec and HP Compaq’s PC system recovery. Let me take a moment to explain how these restores work. When your hard drive is installed at the factory and the operating system loaded, a very small semi invisible partition area is created at the beginning of the drive. This small partition usually uses about 2 gig of your drive and is used to store a compressed image of your machine as it was when it left the manufacturer. In other words, it takes a snapshot of how all the software was loaded and stores that in the tiny partition. If something happens to your operating systems and you can no longer get into Windows, you employ this partition.

In your documentation there is an explanation of how to get into you recover partition or diagnostic partition and is usually done by hitting F10 when you boot up. At this point you will be asked to make sure you have your data backed up and then you will be asked if you would like to restore your machine. If at the time you’re doing this you happen to be speaking with the manufactures technical support people they advise you to click yes and continue the restore procedure. Now, the party is over and from this point forward your data has become highly compromised, if not totally destroyed. Understand that the tech support at the manufacturer only cares about getting the PC back up and running and feel no responsibility to your data. This is an important point that must be clearly understood. They don’t care about your data or if you need hard drive recovery.

Ok so now you have run the system restore, you boot in to windows and low and behold all of your data is gone. Your operating system and applications have been restored to the original state and your data now resides in the Twilight Zone. The following are the steps you will need to take in order to try and recover some of your data files (ie .jpg, .doc, .mp3) for hard drive recovery.

Dell Compaq and HP System Restore feature and how to recover your data files.

1. Move the hard disk to another computer either via USB chassis or by slaving it to another PC. Please see DTI’s blog if you don’t know How To Slave A Hard Drive.
2. Purchase a piece of file carving or file harvester software for a raw file recovery. The piece of software that we sell that does this kind of data recovery is Fast File Finder the link will take you to the download page where you can download the demo. Like all of DTI Data Recovery’s software, it will show you your data before you buy it! We have a long list of file types that we can recover and hopefully yours will be on it. Data Recovery Software like this normally recovers many different types of data file formats.
3. Run a scan of the hard drive and see what files Fast File Finder locates.
4. Save the files to a different hard drive because you do not want to put any data on the hard drive you are trying to recover from. Let me say that again, do not save the data to the physical drive you are trying to recover data from.
5. Lastly, go through all the files that the raw file finder has recovered for you and see if your data is there.

If you had not defragged your drive in more then 2 weeks before the system restore a lot of the files will be corrupted due to file fragmentation. You can see DTI’s blog on how to set up a scheduled defrag so that in the event that this happens again you will be prepared. You will also notice you have lost all your directory structure and file names. It is unfortunate, but because you have a perfectly good working file system at this point, and all of the old information in the Master File Table, Partition Sector, and Master Boot Record have all been over written this is the only option. The best way to avoid hard drive recovery all together is to back up often!