Here is a further examination in this example for a deleted file called MyFile.txt (from a previous example).
Here is a scanned folder which contains a record for this file:
The size of the deleted file can be calculated based on the root entry structure. The last four bytes are 33 B7 01 00. By converting them to a decimal value (changing the byte order), the result is 112435 bytes. The previous 2 bytes (03 00) is the number for the first cluster of the deleted file. Repeating the conversion operation, the result is 03 - this is the start cluster of the file.
This is what is in the File Allocation Table for the above example:
Zeros! This is good - it means that these clusters are free, i.e. the file has most likely not been overwritten by another file's data. Now, with the chain of clusters, 3, 4, 5, 6, the file is ready to be recovered.
There are many cases where a file's data cannot be successfully recovered because a cluster's chain cannot be defined. This mostly occurs when other data (files, folders) are written onto the same drive where deleted files exist. Attempting to recover such a file may result in a warning to appear as in with Active@ File Recovery.
You can try to define a cluster chain manually by using low-level disk editors; however, it's much simpler to use a data recovery tools, like Active@ File Recovery.
This document is available in PDF format,
which requires Adobe® Acrobat® Reader