Quantcast
Channel: Reading MFT
Viewing all articles
Browse latest Browse all 444

Reading MFT

$
0
0
Hey guys, great thread and especially great snippets!

Currently I am working on an application that basically has to be able to undelete data from both NTFS and FAT32 drives.

I've started working on the NTFS part. So far, your posts were extremely helpful!

Everything is working nicely... But I am still a bit far away from recovering data...

Basically, the next step would be selecting those files that are "flagged" as deleted. By now, as you know, the output of EnumerateVolume only stores files that are in use (those files visible to the operating system).

Could anyone please tell me what changes I should make in order for the previously mentioned thing to happen?

Thanks!

Viewing all articles
Browse latest Browse all 444

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>