"Un-Delete" vs Full Recovery

[Questl]

Hi, longtime returning user, this time I whoops deleted a whole giant folder in trying to delete one file. I'm pretty knowledgeable about how hard disks work, the drive is external and PRISTINE - I haven't touched it since deleting and came straight here. Now I want to know three things. First, is there a way to simply change the "writeable" bit at the start of each file, without having to copy each file? I figured that's what Recuva would try first, but when I try to recover to the same directory, an overwrite warning pops up. This folder is huge. It will take half a day just to recover it on another hard drive, and another half a day to move it back where it already is. Please tell me there's a simpler way. Second, if this isn't the case, is fear of overwriting real if all files are in "Excellent", non-overwritten condition? Lastly, as I mentioned, I was trying to delete *an* file. If I don't check the recovery box for that one...will that botch recovering all proceeding files in the same place? Mostly I don't want to have to recover to another partition. I'm running on very limited space from a tiny laptop what copies slowly.

[Augeas]

!) No. Assuming your file system is NTFS, the folder is entirely within the Master File Table (MFT). This is a very complex index, and critical too. Each record in the MFT is 1024 bytes in size and the folder, being giant (meaning many entries?), will have many extension records, and highly likely further index records that hold the addresses of the extension records. Each of the files in the folder will also have an MFT record, and large files with many fragments will also have index and extension records. Then there is the MFT bit map, which identifies which records are in use and which deleted. Moving to data clusters, there are a million for each gb of data, all recorded in the cluster bitmap, which again identifies free and in-use clusters. If you want to shrivel a lot of brain cells, try grasping little-endian hex bit-map processing.

 

On an external drive all of these items might - just might - appear to be unsullied. But on file deletion NTFS zeroes the links from the MFT folder/file record to any extension records, and zeroes the cluster addresses in the extension records. So any attempt to reconstitute the folder structure is doomed (even if NTFS would allow it, which it doesn't). So Recuva doesn't even try.

 

2) Fear of overwriting is very real. Recovery is writing a new file back on to a drive so any previously deleted file - including the one you're recovering - is in danger of being overwritten. NTFS does not know or care about your recovery, it writes the new file where it pleases. Recovering to the same drive is possible for a few small files on a drive with plenty of space, and even then you take your chances on the recovery overwriting what you're trying to recover, A giant folder? Don't even think about it.

 

3) I don't think I understand the question.

[Questl]

NOOOOOOOOOOOOOO

 

Alright. Now that's out of the way, thanks for the help. Guess I'll go dig up my old hard drive and get to cracking this afternoon. Question three was irrelevant if question two proved impossible. I thought the drive was fat, it's not that big, but apparently at least the partition I'm recovering from is NTFS. C'est la vie. I'm glad someone here was able to help so quickly, definitely remembering y'all the next time I hit delete erroneously.