Baseline ideas for Data Recovery App

[kxcntry99]

Hi everyone,

I have been doing some research on a project I think I would like to start. I recently used a NTFS data recovery app on a corupt HD. The way it worked intreagued me and the "chalange" has been made that no recovery app has been made in vb.net as of yet. Apparently most recovery apps are written in C++ or something closer to the disk coding itself. So there is my challenge.

I have done a fair amount of research on the way that NTFS is structured and it seems that there are plenty of safeguards written into the structure to make it a little easier to do a recovery.

I have also been given somewhat of a starting point by dynamic_sysop (thanks!) to try and use the DeviceIOControl Api, Readfile / Createfile api. i am not sure how much of the DeviceIOControl I will need to use as of yet but I can understand the Readfile, Createfile, and Writefile functions.

I have been trying to create some kind of work flow before I start programming. If my intention is to work on dammaged disks or disks that have been formated so the first step in my app would be to get a source to work on, either driveimage or the physical drive (hopefully users would not use this). I will get into making the drive image down the road but, after the source has been declared then I would think an absolute read of the media would be in order. I would that after the read was complete I could show the files in some kind of tree view and copy any selected files to a separate destination.

My first question is this...what on the disk should be my target of the initial read of the disk? Should I even bother with the MFT or go straight for the Datafiles? One the one hand if I go for the MFT I could get a list of every file that was on the disk. However, not all of the files in the MFT could be recoverable, depending on the amount of damage to the disk. I could go straight for the Datafiles and use the headers to get info about the individual files, however, I would potentially be skipping over the smaller files that could fit in the MFT. I am thinking to go for the MFT and then use the sector start and stop points to pull back only the files the user wants recovered.

My next question is to do the absolute read would I need the DeviceIOControl as dynamic_sysop had suggested, or could I get away with doing just a create file from the user defined source?

I hope to learn a lot from this project so any suggestions would be apreciated.

Thanks