File Recovery and Disk scan for deleted entries

Disk scan for deleted entries

Disk Scanning is a process of low-level enumeration of all entries in the Root Folders of FAT12, FAT16, FAT32, Master File Table (MFT), NTFS, or NTFS5.

The goal is to find and display deleted entries.

In spite of different file/folder entry structures among different file systems, all of them contain basic file attributes like: name, size, creation and modification date/time, file attributes, existing/deleted status, etc...

A drive contains a root file table and any file table (like a MFT, a root folder of the drive, a regular folder, or even a deleted folder), and has a location, a size, and a predefined structure. It is therefore possible to scan the drive from the beginning to the end while checking each entry to discover if it's deleted or not and display information for all found deleted entries.


Deleted entries are marked differently depending on the file system. For example, in FAT, a deleted entry for any file or folder is marked with the ASCII symbol 229 (OxE5) which becomes the first symbol of the entry. In NTFS, the deleted entry has a special attribute in the file header that points to whether the file has been deleted or not.

Example of scanning folder on FAT16:

This folder contains 3 entries, one of them is deleted. The first entry is an existing folder called MyFolder. The second one is a deleted file called MyFile.txt. The third one is an existing file called Setuplog.txt.

The first symbol of the deleted file entry is marked with the
E5 symbol, so a Disk Scanner can assume that this entry has been deleted.

See also: Example of scanning a folder on NTFS5 (Windows 2000)