What to do when all file system is erased
Hi guys! I am new here. I have a small data recovery software site ( http://www.floborecovery.com . And I am quite experienced in data recovery.
I am devoloping a new technology that the data recovery issue when all file system information is erased(overwritten). As you know common software for file recovery from a damaged partition are using file system information(FAT,NTFS,Ext2,etc). the some, undelete software, are using the some thing.
When a virus erase all file system information, the recovery of the files are a big problem. One sollution is trying so called "raw recovery" that tried to identify by header signature, the file and recover it. But, this fails when the file is fragmented. As we know most users have above 70% fragmentation level. So, is not a complete sollution.
So, I am developing a new techmology that is able to recover filesno matter the file system and the fragmentation. I know it sound impossible but I succeded for .dbf files at the moment.
What do you think about this? How many times you encountered file system totally erased? What are the most important files from your point of view?
Data recovery is indeed an art. The most important file is the $MFT (NTFS) or FAT. You can recover anything else with it, given enough time. Nothing is impossible, but I would love to know how you plan to locate a file's extents without the $MFT.
Good luck on your ambitious project.
I forgot to answer your other question, I very rarely encounter a system whose entire file system has been deleted.
But the scanpst.exe function that everyone gets with windows may work this way. It does a very good job of parsing .pst file fragments from unallocated space. Those files are very fragmented typically, and I've used to pull out a lot of .pst file information.