Jump to content
CCleaner Community Forums
Sign in to follow this  
Super Fast

NTFS 2cd recovery record

Recommended Posts

I am told that there are 2 copies of the MFT in NTFS file systems.

Any way to take advantage of that & create more reliable recoveries?


Because I have a system I was recovering files off of (documents) & only 2 or 3 of the documents actually worked after recovering!

Was wondering if you can use the 2cd recovery record to make it recover otherwise "unrecoverable" media by interpolating the "missing" or "incomplete" data!


Just wondering...


Was using it on XP SP2 system & the very latest greatest recuva 1.39 or so.

Share this post

Link to post
Share on other sites

Unfortunately not. The MFT Mirror is only one cluster in size and holds a copy of the first four records of the MFT. If any of those records in the MFT are corrupted then records from the MFTMirr are used instead.


If you use Recuva to show non-deleted files then you can see the size of the $MFTMirr. The first four records Recuva shows ($MFT, $MFTMirr, $LogFile and $Volume) are those held in the MFT Mirror.

Share this post

Link to post
Share on other sites

If the data had been overwritten by other files as is usually the case then multiple copies of the MFT won't help you recover them.


Richard S.

Share this post

Link to post
Share on other sites

Thanks for the help!


Can you guys please post additional info on your website about the recovery capabilities of Recuva?


What I mean is, I have to have low level access sometimes & I do have one that can read drives that sometimes get scrambled MFT records & show RAW "This drive is not formatted. Would you like to format it now?" when viewed from Windows Explorer.


It can also read from protected user accounts. Sometimes if windows fails & you lose your password protected account because the security ID changes when you do a recovery re-install of windows, you cannot access the folder & Windows Explorer shows 0 KB (blank) folder, & says "Access Denied"


I know this is false, because the one I use can recover files from the user account anyway, so it must be doing low level access or something, bypassing the Windows native way of viewing.


Just wondering, does Recuva support the following?


- Raw Mode drives

- Old password protected user accounts that you got locked out of during a repair install


I know it is possible, because the one I use sometimes does it, but I found no mention on Recuva website about if it supported that to my knowledge.

Haven't had time to test it yet on one of my disks, because I simply do not have a corrupted disk at the moment.


Do you think it is possible to list if it supports that, & maybe if it doesn't add it as a feature?

I think Recuva is wonderful & very easy to use.


The only reason I wouldn't use it more, is I know at one time, it did not support RAW drives, which is a must. I can't afford to "lose" several gigs of backups!


Thanks, guys!


You all rock!

Share this post

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Create New...