Ever recovered meta files?

[Augeas]

You do a scan with show undeleted files and there in all their glory are the meta files that drive your system ($MFT, $BadClus, $Boot etc). Now the temptation to recover them to a flash drive and then have a look inside is well, for some of us, quite high. Has anyone done this?

[DennisD]

Nope, never done that. But I think we may find out when you eventually succumb to the temptation.

[login123]

Yep, just did, got'em on usb drive right now. mft is 96,288 kb, not sure if it will open w/ peek, will try. Peek is a simple binary viewer available here.

 

Back in a minute.

 

edit

 

$mft did open w/ peek in the form of a big text file, don't quite know how to describe it. There are plain text references to files that I remember, some websites I remember, bunch of stuff I don't recognize at all.

 

$bitmap showed nothing in peek, and quite a lot of undecipherable characters in notepad.

 

$boot opened with peek to show a small plain text file. No idea what any of it means

 

Apparently no harm done here.

 

Didn't see anything called $badclus.

Edited October 8, 2010 by login123

[Augeas]

You're a true pioneer, Login. I'll have a go when I have a few hours spare.

[login123]

Pioneer? Ha. Just a scaredy cat hiding behind Powershadow. If there is some better application for looking at that saved $mft file I'll use it and post a screenshot. I just used peek because it is quick. I know recuva gives a preview...that's a little scary...but there may be something better??

 

The whole business only took about 15 minutes, including installing Recuva...the rest of the time was spent being careful, taking baby steps.