The Data recovery is of two types … One method is by using a software that can recover files.There are certain benifits and risks by using this way. \'File System has file records and each file record is stored in Master File Table(MFT).MFT doesnt have file data but has only information about the file,which is used while retrieve the file. Each file and folder stored in File System has its entry in Master File Table. Even deleted files and folders also have there entry in Master File Table until it is reallocated to other file or folder. We also know that $BITMAP metadata file has information about allocation status of disk clusters. Using this information we have proposed the technique to recover deleted files from File System partition which is given below: Steps followed in deleted file recovery are: 1.Search Files MFT Entry 2. Process it’s $DATA attribute 3. If $DATA attribute is resident, file content is present in MFT Entry. Just copy it to external location to complete recovery process. 4. If $DATA attribute is non-resident, file’s contents are present in external cluster. Then parse the RunList present in the attribute. 5. Check if each cluster listed in Runlist is allocated or not. If all clusters have allocated status as 0, means that the files data is still present on disk. Therefore complete recovery is possible. Copy file’s contents to external location to complete recovery process. 6. If some clusters have allocated status as 1, then the partial recovery is possible. Copy file’s contents to external location with reallocated cluster’s values as zeros to complete partial recovery process. If all clusters have allocated status as 1, then the file’s contents are lost and recovery is impossible. The above technique can handle the file’s data which is fragmented across number of cluster runs so gives more granular results in recovery of deleted files. The technique does not require any external storage or use of sorting therefore can increase the performance in recovery process of deleted files. As we are discussing the file recovery through software the recovery software starts by trying to read and process the first copy of the info about files and folders. In some cases such as accidental file deletion, this is the only step where we can recover the file entirely If the first copy of the info about files and folders is severely damaged, the software scans the disk for the second copy of the info about files and folders. It also attempts to glean additional information about the folders and files structure that may be on the data part of the disk. Then, it processes all this information to reconstruct the original folders and file structure. If the file system on the disk isn\'t severely damaged, it is often possible to recover the entire file and folder structure. If the file system on the disk is severely damaged, this recovery method cannot recreate the entire folder structure. Then these files are stored in the unkonwn folders..

1. The Data recovery is of two types …
One method is by using a software that can recover files.There are certain benifits and risks by
using this way.
'File System has file records and each file record is stored in Master File Table(MFT).MFT
doesnt have file data but has only information about the file,which is used while retrieve the file.
Each file and folder stored in File System has its entry in Master File Table. Even deleted files
and folders also have there entry in Master File Table until it is reallocated to other file or folder.
We also know that $BITMAP metadata file has information about allocation status of disk
clusters. Using this information we have proposed the technique to recover deleted files from
File System partition which is given below:
Steps followed in deleted file recovery are:
1.Search Files MFT Entry
2. Process it’s $DATA attribute
3. If $DATA attribute is resident, file content is present in MFT Entry. Just copy it to external
location to complete recovery process.
4. If $DATA attribute is non-resident, file’s contents are present in external cluster. Then parse
the RunList present in the attribute.
5. Check if each cluster listed in Runlist is allocated or not. If all clusters have allocated status as
0, means that the files data is still present on disk. Therefore complete recovery is possible. Copy
file’s contents to external location to complete recovery process.
6. If some clusters have allocated status as 1, then the partial recovery is possible. Copy file’s
contents to external location with reallocated cluster’s values as zeros to complete partial
recovery process.
If all clusters have allocated status as 1, then the file’s contents are lost and recovery is
impossible. The above technique can handle the file’s data which is fragmented across number of
cluster runs so gives more granular results in recovery of deleted files. The technique does not
require any external storage or use of sorting therefore can increase the performance in recovery
process of deleted files.
As we are discussing the file recovery through software the recovery software starts by trying to
read and process the first copy of the info about files and folders. In some cases such as
accidental file deletion, this is the only step where we can recover the file entirely
If the first copy of the info about files and folders is severely damaged, the software scans the
disk for the second copy of the info about files and folders. It also attempts to glean additional
information about the folders and files structure that may be on the data part of the disk. Then, it
processes all this information to reconstruct the original folders and file structure.

2. If the file system on the disk isn't severely damaged, it is often possible to recover the entire file
and folder structure.
If the file system on the disk is severely damaged, this recovery method cannot recreate the
entire folder structure.
Then these files are stored in the unkonwn folders.
Solution
The Data recovery is of two types …
One method is by using a software that can recover files.There are certain benifits and risks by
using this way.
'File System has file records and each file record is stored in Master File Table(MFT).MFT
doesnt have file data but has only information about the file,which is used while retrieve the file.
Each file and folder stored in File System has its entry in Master File Table. Even deleted files
and folders also have there entry in Master File Table until it is reallocated to other file or folder.
We also know that $BITMAP metadata file has information about allocation status of disk
clusters. Using this information we have proposed the technique to recover deleted files from
File System partition which is given below:
Steps followed in deleted file recovery are:
1.Search Files MFT Entry
2. Process it’s $DATA attribute
3. If $DATA attribute is resident, file content is present in MFT Entry. Just copy it to external
location to complete recovery process.
4. If $DATA attribute is non-resident, file’s contents are present in external cluster. Then parse
the RunList present in the attribute.
5. Check if each cluster listed in Runlist is allocated or not. If all clusters have allocated status as
0, means that the files data is still present on disk. Therefore complete recovery is possible. Copy
file’s contents to external location to complete recovery process.
6. If some clusters have allocated status as 1, then the partial recovery is possible. Copy file’s
contents to external location with reallocated cluster’s values as zeros to complete partial
recovery process.
If all clusters have allocated status as 1, then the file’s contents are lost and recovery is
impossible. The above technique can handle the file’s data which is fragmented across number of
cluster runs so gives more granular results in recovery of deleted files. The technique does not
require any external storage or use of sorting therefore can increase the performance in recovery
process of deleted files.

3. As we are discussing the file recovery through software the recovery software starts by trying to
read and process the first copy of the info about files and folders. In some cases such as
accidental file deletion, this is the only step where we can recover the file entirely
If the first copy of the info about files and folders is severely damaged, the software scans the
disk for the second copy of the info about files and folders. It also attempts to glean additional
information about the folders and files structure that may be on the data part of the disk. Then, it
processes all this information to reconstruct the original folders and file structure.
If the file system on the disk isn't severely damaged, it is often possible to recover the entire file
and folder structure.
If the file system on the disk is severely damaged, this recovery method cannot recreate the
entire folder structure.
Then these files are stored in the unkonwn folders.