Comprehensive search method allows finding and rebuilding in memory directory structure of a damaged file system.
It is recommended to perform FAT/NTFS search over a selected area of a physical device rather than over a logical disk. The software may read beyond the selected area if it is necessary.
If a file system is not seriously damaged then the volume found can be opened before search completes. If the opened volume does not contain necessary files or they are being recovered incorrectly you may continue the search or try opening another volume.
| Open volume | Open volume selected in the list. |
|---|---|
| Save... | Save search log to a file. |
| Load... | Load search log from a file (to continue previous search or to use previous search results). |
| Start/Stop | Start/stop scan. If the scan area is not changed the scan will continue from the last point. |
| Scan range | Select the area to scan. Is is possible to select one of the partitions or any drive extent. |
The special search method allows detecting volumes without prior complete scan of the selected area. The volumes with the most number of files are being found first. Some fake volumes may be found by mistake (e.g., if partitions were moved or resized) so it is recommended to define the most exact area to scan. If data was moved over disk some files of one volume may be found on different volumes. Moreover, the one file may be found on different volumes. However, generally the file is recoverable correctly from one volume only.
Upper list displays found volumes. Column Check generally corresponds to recovery quality of a found volume. Volume sorting order can be changed by clicking a column header (or by selecting the header and pressing Enter key in the console version). Sorting by Volume Number, Volume Start, and by Check is supported.
LBA Size of the volume is estimated on the base of the best MFT fragments and it is not exact.
When NTFS Search is stopped you may connect/disconnect MFT fragments to the selected volume before opening.
For the selected volume the number of the found files and total possible number of the volume files is shown (in parentheses there is a number of found files include duplicates).
MFT Volume Start #1 and Volume Start #2 are possible volume starts for a given MFT fragment (in parentheses there is check).
Volume Mod = Volume Start mod Cluster size
MFT Mod = MFT Cluster Start mod Cluster size
Signs "-" in the columns Boot FAT1 FAT2 Root indicate the absence (damage) of the corresponding file system structures (boot sector, main FAT table, FAT table copy, root directory).
The column Found shows the number of directories found and generally indicates the recovery quality of the volume.
Values of the columns Boot FAT1 FAT2 Root are the corresponfing offsets (in sectors) from the Data start (back).