Data Extractor supports following operations with map:
Data Extractor 支持以下位图操作:
– Merge (two) maps;
– Intersection (two) maps;
– Merge (two) maps without crossing;
– Cut (another) map (from current);
– Compress map;
– Inversion map.
A map is a suite of sectors, which are contained in one file.
We can describe operations with maps by schemes:
The Merge maps is the set of all sectors that are members of either one map or other.
The intersection of maps is the set of all sectors that are members of both maps.
Merge maps without crossing is the set of all sectors that are members of either one map or other but not of both maps.
Cut (another) map (from current) is the set of all sectors that are members of (current) map but not members of (another) map.
Inversion map is the set all sectors that are not members of current map.
Bad sectors in MFT map
We have received on-and-off cases where some files are lost due to bad sectors in MFT map. Partition analysis doesn’t help in these cases.
Only way to get data is RAW recovery, but there is one problem: we don’t know where to search these lost files.
We can build two maps:
1. Used sectors map (from Bitmap). NTFS is a journaling file system and uses the Bitmap ($Bitmap) to record whether its corresponding cluster is used (allocated) or free (available for allocation). So we can build map from Bitmap.
2. Map of Root folder. This map indicates all files are shown in Explorer of Data Extractor.
There is detailed procedure how to get this map:
1. Build map of Root
2. Save it file 保存文件
3. Come back to Explorer and build used sectors map from Bitmap
4. Cut the map 选择位图
5. Run RAW recovery