Newbie question on $MFT

Log Out | Topics | Search Moderators | Edit Profile

Author Message   Nitin Kushwaha Username: thexplanet Registered: 1-1997 Posted on Sunday, Jun 14, 2009 - 23:09:    Hello all, and excuse me for asking a simple and basic question, I just open the image which was formatted with NTFS, and I can see the $MFT,$MFTMirror..and other $MFT records/attributes. My question is, how can i view the file names of the deleted files from the OS, and how do i see the resident files within the $MFT, I just need help with Winhex-Menus and how to show up the file names in the $MFT, and $Volume as well Thanks in advance.   Stefan Fleischmann Username: admin Registered: 1-2001 Posted on Sunday, Jun 14, 2009 - 23:19:    All files referenced in the $MFT, wether existing or deleted, are listed in the directory browser (the list of files), for NTFS partitions/volumes on disks that are opened in WinHex, and for NTFS partitions/volumes in image files, if these images files are interpreted as disks (requires a Specialist license).   Nitin Kushwaha Username: thexplanet Registered: 1-1997 Posted on Sunday, Jun 14, 2009 - 23:22:    thanks!   isaac Username: isaacimayan Registered: 1-1997 Posted on Tuesday, Jun 16, 2009 - 15:41:    hi there I am a new user of winhex., and i do have only the Academic licence., can you please tell me the step by step how to recover the deleted files from my memory card., Thanks   Björn Ganster Username: admin4 Registered: 3-2004 Posted on Wednesday, Jun 17, 2009 - 11:06:    Please consult the WinHex manual section on "Data Recovery".