Recover Lost Data 

Have you ever accidentally deleted some important files or lost them to a virus attack? Or possibly, formatted your machine's hard drive only to remember later that there were some important files in it? In this article, we'll talk about how to recover such data from an NTFS partition using a free (Scrounge- NTFS) and commercial (Getdataback for NTFS) tool. The Scrounge-NTFS even lets you recover data from an accidentally formatted hard drive. You'll find both these tools on this month's Essential CD. Note that since data recovery is a sensitive process, we recommend you have another hard drive handy for restoring all the recovered data. 

Scrounge-NTFS 



You will find this command-line tool as a zip file called 'scrounge-ntfs.zip'. Unzip it to your XP or 2000 Pro machine. It unzips into a single executable file 'scrounge-ntfs.exe'. To recover data, open the command prompt, for this click on Start>Run and type cmd.exe. This will open a command window for you and run the following command.

C:\> scrounge-ntfs.exe -l 

This will give you details of all hard drives in your PC and will look something like this. 

Start End Cluster MFT 



Sector Sector Size Offset


Drive: 0 


63 40965687 8 6291456


40965813 78156162 8 6291456

We used a single 40 GB hard drive with two NTFS partitions, when we tried to recover the lost data. Drive:0 is the connected drive, 63 to 40965687 are the starting and ending sectors of the first NTFS partition, while 40965813 to 78156162 are for the second NTFS partition. 6291456 is the MTF (Master Table File) record. 

Note down all these values, as you'll use them to recover data. The command syntax for this tool is as follows. 

scrounge-ntfs <-d drive> <-m mftoffset> <-c clustersize> <-o output folder> start-sector end-sector

In our case the parameters were as follows: 

C:\> scrounge-ntfs -d c: -m 6291456 -c 8 -o d:\recoverd 63 40965687

This command will scan your C: (NTFS partition) and recover the deleted data to the 'd:\recoverd' folder. 

Getdataback for NTFS 



To recover data you'll need to install a licensed copy of Getdataback for NTFS on a separate machine. This month's Esential CD carries its trial version, which will only show you the recovered data from your NTFS partition, but won't let you recover it. 

So once you have installed the software, plug-in that drive from where the data was lost as a secondary drive in the machine.

Now run Getdataback for NTFS from Start> Programs>Runtime Software. You will get a five-step wizard. 

Step one will show all the connected storage, from where you can select the drive from which the data has been lost. In step two, you will have to select the source logical partition of the selected drive. Step three will ask you to set the range of the file system to be scanned. Here, in the 'Source Disk' section, you will have two options 'Entire Disk' and 'Partial Disk'; select any one of them according to your need, and it will start scanning. After this it will give you a list of NTFS file systems, from where you need to select the file system that needs to be scanned, and the data can be recovered, in the fourth step. Click on Next and it will scan for the lost data from the selected file system. 

After finishing this scanning process, step five will show all the recovered files. In case of a licensed copy of Getdataback for NTFS, just select the recovered files and press F5. You will be asked to give the path, where you would want to save the recovered data. 

Sanjay Majumder