Tuesday, 15 June 2010

Folder tree structure vs. file data

Is it possible for a data recovery software to get a correct file and folder structure but bad file content or vice versa? Why does it happen?

The answer depends on the filesystem type being recovered.

On FAT, the location of the parent folder is determined depending on the same formulae which are used for finding data. If the parameters in these formulae are invalid, neither data nor a folder structure can be restored. Hence, typically if you have a folder tree recovered properly or close to that, the files should be good as well.

On NTFS, there are two independent sets of parameters, one set controlling the data location and the other set covering the parent-child relationships in a folder tree. So on NTFS, it is theoretically possible (and sometimes happens) to have one good set of the parameters but the other one wrong. So, if you unformat an NTFS drive, a good folder tree full of damaged files is perfectly possible.

On HFS and HFS+, the parent-child relationship is described by designated records in the catalog file. So it is possible to recover a folder tree even if both child and parent folder records are damaged. HFS utilizes three different datasets to store information about the file data, file names, and content of the large files. Any of these three may be damaged separately, leading to all sorts of combinations being possible.

No comments:

Post a Comment