Recovering Data Using MFT Records in NTFS File System

Abstract

Data storage devices use a specific structure when storing or accessing the stored data. This is called file system. Before beginning to store data in the data storage device, it must be formatted absolutely. While this data storage device is being formatted, the file system should be selected.NTFS, the most commonly used file system, keeps the files in the disk as a list in the MFT (Master File Table) file. Even if the file is deleted, the file record in this table will not be deleted. The physical location of the file can be found by looking at these MFT records.In this study, computer software was created on the basis of restoring the disk using a MFT file of the NTFS file system, and the result was examined.When national studies are examined, data recovery programs on the market are compared with each other. When international studies are examined, it is seen that NTFS and MFT concepts are explained but data recovery method using MFT records is not examined in detail.