MRT DE - image a couple specific folders only

[lcoughey]

For data recovery professionals, it is very important to be able to quickly target key files and folders that clients need recovered as a priority. But, how you image the sectors connected to those files and folders can have a huge impact on the stability of the drive. The best method to do this is to determine all the sectors connected to the target files and start imaging the drive from beginning to end, skipping any sector that is not connected to any of those target files. This is how data recovery professionals do it with hardware recovery tools like DeepSpar Disk Imager and PC3000 Data Extractor. But, when it comes to MRT Data Explorer, the only option is to image one file at a time, which is very hard on the drive as the heads thrash all over the place.

That is a huge strike against MRT in being a low cost imaging alternative to DeepSpar Disk Imager and PC3000.

[ddrecovery]

Can't wait for Amarbir's reply............

[maximus]

(In my Yoda voice) Open the door for me you have…

Sometimes I like to hear things like this, that other tools don’t perform as desired. Especially when I have just recently started working using DMDE with the HDDSuperClone virtual disk, and added an option to import a sector (must be in bytes) file from DMDE into HDDSuperClone. This can allow for targeting either used space or specific folders/files. And in the case of specific data, DMDE seems to only access the needed parts of the file system to get the list for those sectors, and doesn’t even need to read the whole file system. So it doesn’t even need to thrash on the whole MFT (NTFS), although some thrashing will happen as it will jump around as needed to get the sector list. Once the desired list is imported into HDDSuperClone, the cloning process can be started, targeting only those sectors (the domain), using all phases just as cloning would. Finish the cloning process to the level desired with that domain, and then the files can be extracted. It is then possible to continue on with either targeting more specific data, the used space, or the whole drive.

Of course HDDSuperClone does not perform any firmware fixes, so if something like that needs to be done to get the drive operational, then you would still benefit from those functions in MRT. And if you need to use a loader to get access, than you would not be able to use HDDSuperClone. MRT would still be needed for the harder cases. But if the drive is not supported directly by MRT for these things, then the playing field is more even.

(Yoda voice again) Very affordable option this is, video examples made have I, try it you should, find it useful you will…

[lcoughey]

The way it should work is to image the MFT first, then read the file tree from the already imaged MFT. Then select and create a map of sectors associated with the files you want to target. Then image just the mapped sectors without thrashing. When complete, generate a file tree showing the files that are good and damaged (one or more unread sector).

After targeting the key files and folders, go back and image by bitmap, followed by getting a full clone of the drive. The full clone is more important to me if we have a case of file system damage and cannot be sure that we recovered all the files and may need to resort to a full scan of the drive.

[RolandJS]

"...how you image the sectors connected to those files and folders can have a huge impact on the stability of the drive...determine all the sectors connected to the target files and start imaging the drive from beginning to end..."
The thread mentioned MFT HDD thrashing, won't there be some wear and tear, albeit non-thrashing, as the [que Leonard Nimoy] In Search Of [/que LNimoy] process searches the whole HDD?

[lcoughey]

The MFT is just a single file, usually in a few fragments. Read the fragments as separate chains and be done with it. It is when you get into FAT and EXT file systems that it becomes super messy pretty much better to just get a full clone of the drive before any file system recovery attempts.

[maximus]

FYI when I posted I did not realize it was directly in an MRT forum section. I did not mean to hijack a thread in another software/hardware section.

But I am very surprised that MRT does not work like that. From everything I have ever read I was under the impression that it was a poor man’s PC3000. I would have thought that targeting files in that way would have been possible. Being able to do that in my software has been on my bucket list for a long time, and I just finally recently managed to do it. I consider my software to be a poor man’s DeepSpar, and I am happy now for it to be able to target files in a good way (like what you are saying MRT can’t do). And it can target the whole MFT first if desired. But maybe the ability to target files without needing to read the whole file system could be beneficial for some cases or file systems. I do agree that targeting the file system and files should be able to be done in a linear way when possible to avoid unneeded thrashing on the drive. That seems like a big oversight on MRT’s part.

[RolandJS]

I missed the part about only searching MFT area! My bad