Baseline ideas for Data Recovery App

Hi everyone,

I have been doing some research on a project I think I would like to start. I recently used a NTFS data recovery app on a corupt HD. The way it worked intreagued me and the "chalange" has been made that no recovery app has been made in vb.net as of yet. Apparently most recovery apps are written in C++ or something closer to the disk coding itself. So there is my challenge.

I have done a fair amount of research on the way that NTFS is structured and it seems that there are plenty of safeguards written into the structure to make it a little easier to do a recovery.

I have also been given somewhat of a starting point by dynamic_sysop (thanks!) to try and use the DeviceIOControl Api, Readfile / Createfile api. i am not sure how much of the DeviceIOControl I will need to use as of yet but I can understand the Readfile, Createfile, and Writefile functions.

I have been trying to create some kind of work flow before I start programming. If my intention is to work on dammaged disks or disks that have been formated so the first step in my app would be to get a source to work on, either driveimage or the physical drive (hopefully users would not use this). I will get into making the drive image down the road but, after the source has been declared then I would think an absolute read of the media would be in order. I would that after the read was complete I could show the files in some kind of tree view and copy any selected files to a separate destination.

My first question is this...what on the disk should be my target of the initial read of the disk? Should I even bother with the MFT or go straight for the Datafiles? One the one hand if I go for the MFT I could get a list of every file that was on the disk. However, not all of the files in the MFT could be recoverable, depending on the amount of damage to the disk. I could go straight for the Datafiles and use the headers to get info about the individual files, however, I would potentially be skipping over the smaller files that could fit in the MFT. I am thinking to go for the MFT and then use the sector start and stop points to pull back only the files the user wants recovered.

My next question is to do the absolute read would I need the DeviceIOControl as dynamic_sysop had suggested, or could I get away with doing just a create file from the user defined source?

I hope to learn a lot from this project so any suggestions would be apreciated.

Thanks

here's a link to a C++ article on the codeproject --- LINK ---
it shows you that it's fairly complex, if i get time sometime, i may have a look at some of the structures contained in that c++ example, maybe they can then be ported to vb.net / definately to C#
that's for another day tho, bit busy with work & family at present.

Thanks dynamic...I actually ran across that article yesterday but because of all the negative comments I kind of wrote it off. I can see from their code however that they went straight for the MFT's and just worked to read all from the disk then start moving them to a new location.

I will continue to research.

Thanks,

I am still in progress with this project. I recently found this site that allows you to take a snapshot of a floppy disk and copy it to the HD.

http://boycot.no-ip.com/vb/RawReadWriteFloppy.htm

I am working on modifing the code to allow an image of a HD. I have re-worked the project to show me HDs in the dropdown list, however, I am getting an error when it goes to make the image.

Still working to discover why its giving me the error on create image of HD.