NTFS reconstruction options

After about twenty years, I felt ZAR can no longer be updated to match the modern requirements, and I decided to retire it.

ZAR is replaced by Klennet Recovery, my new general-purpose DIY data recovery software.

If you are looking specifically for recovery of image files (like JPEG, CR2, and NEF), take a look at Klennet Carver, a separate video and photo recovery software.

The Master File Table (MFT) of the NTFS volume is not contiguous, but is stored in the several fragments. By design of the NTFS, the MFT Mirror (copy of the several critical MFT entries) is stored separately from the rest of the MFT. Thus, at least two fragments of MFT are stored on the volume. More complex layouts are possible due to additional fragmentation, typically when a volume gets filled near its capacity. Additionally, several MFT entries may be damaged, thus splitting a contiguous MFT fragment in two.

This fragmentation must be resolved and the contiguous representation of the MFT rebuilt. This is required to

• recover large and/or heavily fragmented files,
• properly parse and rebuild the folder and file tree.

If there is a small gap between MFT entries, it is ignored and data processed as two adjacent parts of the same block. This reduces parser workload at a cost of possible misidentification of the fragments. If the physical damage exists (which contributes to these "gaps"), might be reasonable to increase the value up to the half of the "skip factor" as set in bad sector handling settings. Default value is 2.

If nonzero value is set, small MFT runs will be excluded from the analysis. This reduces parser workload similar to the above. High values can degrade folder tree quality. Recommended value is 16 (default).