Saturday, 9 June 2012

NTFS Deduplication

If you use NTFS Deduplication feature on Windows 8 Server (Windows 2012 build 8400), the deduplicated data is not recoverable by regular NTFS recovery software. If there are two copies of the same file on the disk, and the file gets deduplicated, neither of the copies is recoverable with traditional approach.

All the existsing data recovery software working with NTFS will need an upgrade to be able to recover deduplicated files.

Actually, deduplication makes filesystem more fragile.

For a regular file to be recoverable, you need to find its inode and intact file data.

To recover two identical regular files, you need either of the "inode + file data" pairs. Note that file data comes in two copies.

To recover two identical deduplicated file, you need a long list of items all in good condition
  • The inode for either of the file's
  • The inodes of deduplication folder structure to be intact
  • The contents of deduplication tables to de intact
  • The single copy of the data to be intact
  • Last not least, you need a capability to put everything back in proper order. Typically, this involves some reverse engineering effort.

No comments:

Post a Comment