MHDD Data Recovery & Forensics v15 - © 2009 MHDD 1 Hard Drive Kung Fu Magic MFT & File Based Imaging Data Recovery Forensics by Scott A. Moulton www.MyHardDriveDied.com
Dec 24, 2015
MHDD Data Recovery & Forensics v15 - © 2009 MHDD1
Hard Drive Kung Fu Magic
MFT & File Based ImagingData Recovery Forensics
byScott A. Moulton
www.MyHardDriveDied.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD2
Disclaimer
MHDD Data Recovery & Forensics v15 - © 2009 MHDD3
Imaging Traditional Method
MHDD Data Recovery & Forensics v15 - © 2009 MHDD4
What did you miss?
• Time you could have been playing WOW, C&C, Insert Game of Choice!
• Small Files that exist in the MFT!
• Fragmented Files!• Problems with Spares Files!• And you may damaged the
hard drive further reading every sector especially if those are not needed!
MHDD Data Recovery & Forensics v15 - © 2009 MHDD5
The New Way
MFT Imaging&
File Based Imaging
This allows you to recover based on selection allowing
you to be more surgical in your recovery!
MHDD Data Recovery & Forensics v15 - © 2009 MHDD6
MetaData & MFT Files
MHDD Data Recovery & Forensics v15 - © 2009 MHDD7
NTFS Structure (1)
From Microsoft.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD8
NTFS Structure (2)
From Microsoft.com
MHDD Data Recovery & Forensics v15 - © 2009 MHDD9
Exported MFT Records
MHDD Data Recovery & Forensics v15 - © 2009 MHDD10
Badly Fragmented Hard Drive
MHDD Data Recovery & Forensics v15 - © 2009 MHDD11
Concepts
Restore Just Those Files
Image Sectors/Clusters
Use Windows to Select Folders/Files
Image $MFT and $Bitmap
Locate/Select Partition Tables
Image MBR
MHDD Data Recovery & Forensics v15 - © 2009 MHDD12
DeepSpar Disk Imager
MHDD Data Recovery & Forensics v15 - © 2009 MHDD13
DeepSpar Disk Imager
MFT Imaging Demo
MHDD Data Recovery & Forensics v15 - © 2009 MHDD14
END