Hard Drive Kung Fu Magic
MFT & File Based Imaging
Data Recovery Forensics
by
Scott A. Moulton
www.MyHardDriveDied.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 1
Disclaimer
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 2
Imaging Traditional Method
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 3
What did you miss?
• Time you could have been playing
WOW, C&C, Insert Game of Choice!
• Small Files that exist in the MFT!
• Fragmented Files!
• Problems with Spares Files!
• And you may damaged the hard
drive further reading every sector
especially if those are not needed!
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 4
The New Way
MFT Imaging
&
File Based Imaging
This allows you to recover based on
selection allowing you to be more
surgical in your recovery!
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 5
MetaData & MFT Files
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 6
NTFS Structure (1)
From Microsoft.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 7
NTFS Structure (2)
From Microsoft.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 8
Exported MFT Records
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 9
Badly Fragmented Hard Drive
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 10
Concepts
Image MBR
Locate/Select Partition Tables
Image $MFT and $Bitmap
Use Windows to Select Folders/Files
Image Sectors/Clusters
Restore Just Those Files
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 11
DeepSpar Disk Imager
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 12
DeepSpar Disk Imager
MFT Imaging Demo
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 13
END
MHDD Data Recovery & Forensics v15 - © 2009 MHDD 14