Extracting data from damaged NTFS drives | by Andrea Lazzarotto

Introduction

File system analysis is a very important part of digital forensics. A lot of investigations involve hard drives whose contents need to be analyzed. Possibly, deleted files might need to be recovered as well. There are several file system types and NTFS is currently one of the most popular.

File system corruption can occur for several reasons and it may compromise the ability to access and recover files. Hence, forensic tools must understand the structure of a file system and they need to be able to extract as much data as possible, even in harsh conditions. File carving constitutes a popular technique for extracting files from damaged media, however, carved files generally lose their metadata and the directory structure of the partition cannot be retrieved. A better approach is needed because file names, paths and timestamps are very important information.

In this article, you will learn how the directory structure of an NTFS drive can be rebuilt even if parts of the metadata are partial, broken or completely absent. All the phases of the process will be explained. The presented algorithm leads to an interpretation of the file system that allows for the recovery of file names, paths, timestamps and contents of files (including fragmented ones). Finally, you will learn how to use and customize an open source tool that implements these techniques.

How does NTFS reconstruction work?

Read the rest of this story with a free account.

Already have an account? Sign in