How to manually recover files mistakenly deleted in an NTFS volume

For data recovery, although all data operations can be found in the residual MFT after the file is deleted, the smaller the number of data runs, the smaller the file fragments or the less fragmented the file is, the less likely it is to be overwritten, and the higher the probability of data recovery. The following is the process of manually recovering a file incorrectly deleted from an NTFS volume.

1. Documents to be recovered

When a file in an NTFS volume is deleted, the MFT has not been removed, as described earlier, here to restore a deleted file in an NTFS volume, for example, suppose there is a directory named photo in the user's NTFS volume d disk, and there is a file named "Penquan.jpg" under that directory. As shown in Figure 5-1. Suppose the user accidentally deletes this file.

Figure 5-1 files that will be deleted in NTFS volumes

2. Find the MFT to recover files

First, the logical disk where the file is selected is opened by Winhex, as shown in Figure 5-2.

Figure 5-2 Selecting a disk partition