MHDD Data Recovery & Forensics v15 - © 2009 MHDD1

Hard Drive Kung Fu Magic

MFT & File Based ImagingData Recovery Forensics

byScott A. Moulton

www.MyHardDriveDied.com

MHDD Data Recovery & Forensics v15 - © 2009 MHDD2

Disclaimer

MHDD Data Recovery & Forensics v15 - © 2009 MHDD3

Imaging Traditional Method

MHDD Data Recovery & Forensics v15 - © 2009 MHDD4

What did you miss?

• Time you could have been playing WOW, C&C, Insert Game of Choice!

• Small Files that exist in the MFT!

• Fragmented Files!• Problems with Spares Files!• And you may damaged the

hard drive further reading every sector especially if those are not needed!

MHDD Data Recovery & Forensics v15 - © 2009 MHDD5

The New Way

MFT Imaging&

File Based Imaging

This allows you to recover based on selection allowing

you to be more surgical in your recovery!

MHDD Data Recovery & Forensics v15 - © 2009 MHDD6

MetaData & MFT Files

MHDD Data Recovery & Forensics v15 - © 2009 MHDD7

NTFS Structure (1)

From Microsoft.com

MHDD Data Recovery & Forensics v15 - © 2009 MHDD8

NTFS Structure (2)

From Microsoft.com

MHDD Data Recovery & Forensics v15 - © 2009 MHDD9

Exported MFT Records

MHDD Data Recovery & Forensics v15 - © 2009 MHDD10

Badly Fragmented Hard Drive

MHDD Data Recovery & Forensics v15 - © 2009 MHDD11

Concepts

Restore Just Those Files

Image Sectors/Clusters

Use Windows to Select Folders/Files

Image $MFT and $Bitmap

Locate/Select Partition Tables

Image MBR

MHDD Data Recovery & Forensics v15 - © 2009 MHDD12

DeepSpar Disk Imager

MHDD Data Recovery & Forensics v15 - © 2009 MHDD13

DeepSpar Disk Imager

MFT Imaging Demo

MHDD Data Recovery & Forensics v15 - © 2009 MHDD14

END