ntfs file recovery no 80 00 00 00 attribute

[Emil]

Hi folks,

I have a strange situation- i did a recovery from a RAID array which has been partially overwritten. There is 1 file which is very important - I can see it in Explorer mode but the file has no size. I checked the file record of this file and this is what I found:
1. First we have a standard header.
2. Then we have an attribute 10 00 00 00 (standard information) - this is normal.
3. Then we have an attribute 20 00 00 00 (attribute list) - this is quite strange since this usually happens when the file record grows to big and 1kbytes is not enough space to hold it.
4. The attribute list describes that this file has 10 00 00 00 attribute and 30 00 00 00 attribute (name) and no 80 00 00 00 attribute (data). This is very strange.
5. Further we have the 30 00 00 00 attribute, containing the name.
6. Then comes ff ff ff ff - end of file record.

How is it possible that the file record has no 80 00 00 00 attribute? It's quite big file so it's not an Inlined file.

Anyone seen this?

Thanks in advance for your posts.

Regards,

Emil Hristov

[Pepe]

It is because an extension file record is used to hold the data of attribute 0x80, like the attrib list suggests.
U can follow the link in the attribute list to find attr. 0x80.

pepe

Edit: Now I see what the problem is... I misread your post a bit, I thought there is a 80 in the attr list.

The size of this file is 360 bytes, so attr 0x80 should be resident. So there must be some corruption indeed.
one more chance is RAW recovery for the zips and check content.
or check the logfile for older copies of this mft entry, but it is unlikely u will find any.

Try raw!

pepe

[Emil]

Thanks Pepe. It seems indeed like a strange corruption, the file record looks like a normal (not overwritten) file record but still has no 0x80 attribute to describe where exactly the file reside.

By the way, the length of the file record is 360 (decimal) = 0x168, the file itself should be about 100MB (according to customer). Raw recovery remains at the moment the only option - I scanned the disk and found about 4500 zip headers which is quite a lot of work Besides there is a big chance the file got fragmented.