TOC · Work · Menu · Tools

## NTFS/FAT Search

Comprehensive search method allows finding and rebuilding in memory directory structure of a damaged file system.

It is recommended to perform FAT/NTFS search over a selected area of a physical device rather than over a logical disk. The software may read beyond the selected area if it is necessary.

If a file system is not seriously damaged then the volume found can be opened before search completes. If the opened volume does not contain necessary files or they are being recovered incorrectly you may continue the search or try opening another volume.

Open volume | Open volume selected in the list.
Save... | Save search log to a file.
Load... | Load search log from a file (to continue previous search or to use previous search results).
Start/Stop | Start/stop scan. If the scan area is not changed the scan will continue from the last point.
Scan range | Select the area to scan. Is is possible to select one of the partitions or any drive extent.

The special search method allows detecting volumes without prior complete scan of the selected area. Scan is not continuous but sampling with frequency increasing. The volumes with the most number of files are being found first. Some fake volumes may be found by mistake (e.g., if partitions were moved or resized) so it is recommended to define the most exact area to scan. If data was moved over disk some files of one volume may be found on different volumes. Moreover, the one file may be found on different volumes. However, generally the file is recoverable correctly from one volume only.

### NTFS Search

Upper list displays found volumes. Column `Check` generally corresponds to recovery quality of a found volume. Volume sorting order can be changed by clicking a column header (or by selecting the header and pressing `Enter` key in the console version). Sorting by `Volume` Number, Volume `Start`, and by `Check` is supported.

`LBA Size` is the minimum volume size containing all files of the best MFT fragments.

When NTFS Search is stopped you may connect/disconnect MFT fragments to the selected volume before opening.

For the selected volume the number of the found files and total possible number of the volume files is shown (in parentheses there is a number of found files include duplicates).

MFT `Volume Start #1` and `Volume Start #2` are possible volume starts for a given MFT fragment (in parentheses there is check).

Volume `Mod` = Volume `Start` mod `Cluster` size
MFT `Mod` = MFT Cluster Start mod `Cluster` size

### FAT Search

Signs "`-`" in the columns `Boot FAT1 FAT2 Root` indicate the absence (damage) of the corresponding file system structures (boot sector, main FAT table, FAT table copy, root directory).

The column `Found` shows the number of directories found and generally indicates the recovery quality of the volume.

Values of the columns `Boot FAT1 FAT2 Root` are the corresponfing offsets (in sectors) from the `Data start` (back).