Understanding the File Recovery Process The file recovery
process can be briefly described as scanning a drive or folder
to find deleted entries in a Root Folder (FAT) or a Master File
Table (NTFS). Furthermore, scanning for a particular deleted
entry and defining the cluster chain to be recovered and copying
the contents of these clusters to the newly created file.
Different file systems maintain their own specific logical data
structures, however basically each file system: - Has a list or
catalog of file entries, so we can iterate through this list and
entries, marked as deleted - For each entry, keeps a list of
data clusters so we can try to find a set of clusters composing
the file After finding the proper file entry and assembling the
set of clusters composing the file, it is possible to read and
copy these clusters to another location. Step by Step with
examples: However, not every deleted file can be recovered and
there are certain considerations to keep in mind: - Firstly, the
file entry should still