Hello, I work a lot with NTFS file systems. I have already lost many files, due to logical and physical failures in my media. I have always been able to recover some files with a lot of effort and technical research on the subject. I did a program in Pascal, because I could always recover RAW files (photos, music, etc) from a damaged drive, with some tools on the market that promised that. But as the disk structure is corrupted, there is no way to know what each file is about unless I open each one. So, faced with a situation where I had access to my files on the disk (folders and files), but almost everything was corrupted, I created a program capable of comparing these corrupted files, with name and creation date, with the stacks of recovered RAW files. Thus, when a corrupted file has the same length and size in bytes as another RAW file in good condition, it is assumed that the RAW file is the correct file. Then the damaged source file is replaced, optionally in another drive, which is recommended.
But since nothing is perfect, I realized that many files are not found raw by recovery tools. Whenever we try to copy them with recovery programs, such as Getdataback and the like, the file is always corrupted, because the addresses of the clusters no longer match the contents of the file. But if we look in a hexadecimal editor, we find the beginning of the file straight ahead. I thought maybe I could recover files this way if I discovered some misalignment of the original MFT addresses. For example, I have a file that starts at address 200, but logically, it only starts at address 207. Or I can have a file that starts at address 214 but is located at address 221.
Anyway, I lost my data when I corrupted the disk's MBR. So I created a cloned HD image, and formatted it to continue using it. But something went wrong in backing up the image, which made it look incomplete. From there at the end of the record, you probably had some copy of the latest MFT. The MFT that I have probably has old addresses of files that might have been reallocated or moved in place with the disk defragmenter. I'd rather believe that, because I've recovered a lot of whole files, and that's probably a consequence of the Windows disk defragmenter.
I wanted to exchange some experience with people who may have some solution to my problem. Maybe I can recover my data with some technique, or some software that I do not know. I've never seen any small tool on the market like I did. I imagine this would be very useful, since many people lose files, and when they recover, they are all scrambled with numbers instead of the original file name. And if people can retrieve MFT entries, they can have the data back, at least some.