Live Support Chat

Sales & Service Inquiry

If you have any questions and concerns, please fill in the form below and we'll get back to you as soon as possible.



Product Name:

Specific Questions:

File Recovery on NTFS volume

In this section, we'll explain the principle of NTFS file recovery, and the precondition of successful file recovery.

To purchase ntfs recovery, undelete software, please click here.

What happened while a file was deleted in NTFS volume?

In NTFS file system, every file has 1 (sometimes more) file record (usually 1024bytes) linked to it. The structure of the file record is very complex and will not be parsed at this time. The data fields which concerned with NTFS file recovery are:

  1. Flag - indicate the state of the file. eg. existing, deleted;
  2. Data Runs - NTFS file is stored in intervals of clusters called runs. Each run is represented by its starting cluster and its length.

When a NTFS file is deleting, its Flag field will be set to "deleted". Usually, the data of the file will not be cleared after deletion.

How does file recovery software work?

As you can see, there is just one field of the file record was modified after deletion. File recovery software can find this file record, and then pick up cluster number information by parsing Data Runs of the file record. Now software can save data from those clusters to a new file. Thus deleted file can be recovered successfully.


To learn how to recover deleted file by using FinalRecovery, please click here.
To purchase NTFS recovery, undelete software, please click here.