You do a scan with show undeleted files and there in all their glory are the meta files that drive your system ($MFT, $BadClus, $Boot etc). Now the temptation to recover them to a flash drive and then have a look inside is well, for some of us, quite high. Has anyone done this?
Nope, never done that. But I think we may find out when you eventually succumb to the temptation.
Yep, just did, got'em on usb drive right now. mft is 96,288 kb, not sure if it will open w/ peek, will try. Peek is a simple binary viewer available here.
Back in a minute.
edit
$mft did open w/ peek in the form of a big text file, don't quite know how to describe it. There are plain text references to files that I remember, some websites I remember, bunch of stuff I don't recognize at all.
$bitmap showed nothing in peek, and quite a lot of undecipherable characters in notepad.
$boot opened with peek to show a small plain text file. No idea what any of it means
Apparently no harm done here.
Didn't see anything called $badclus.
You're a true pioneer, Login. I'll have a go when I have a few hours spare.
Pioneer? Ha. Just a scaredy cat hiding behind Powershadow. If there is some better application for looking at that saved $mft file I'll use it and post a screenshot. I just used peek because it is quick. I know recuva gives a preview...that's a little scary...but there may be something better??
The whole business only took about 15 minutes, including installing Recuva...the rest of the time was spent being careful, taking baby steps.