Normally if a user accidentially deletes a file and want to recover it then he can take the following steps:
Load one of the many "undelete" tools (like Recuva) and let it detect,analyze and copy the file to another partition.
Now assume that the partition where the deleted files is stored has no traffic (= nothing more is stored there).
So instead of copying the whole file to another partition it should be possible to recover it "in place".
That means a smart undelete-tool should be able just to re-create the previously deleted NTFS entries of the file and the sector chain on the original partition without having to perform a full copy operation..
All information is available.
Unfortunately I did not found such a smart undelete tool .
All of them require a lengthy copy-operation.
Why?
Maybe there is such a tool and I miss it.
Can someone give me a recommendation.
Thank you
Peter
Load one of the many "undelete" tools (like Recuva) and let it detect,analyze and copy the file to another partition.
Now assume that the partition where the deleted files is stored has no traffic (= nothing more is stored there).
So instead of copying the whole file to another partition it should be possible to recover it "in place".
That means a smart undelete-tool should be able just to re-create the previously deleted NTFS entries of the file and the sector chain on the original partition without having to perform a full copy operation..
All information is available.
Unfortunately I did not found such a smart undelete tool .
All of them require a lengthy copy-operation.
Why?
Maybe there is such a tool and I miss it.
Can someone give me a recommendation.
Thank you
Peter
