How drives work · How NTFS finds your files through the Master File Table and folder listings, and why files can be recovered when parts of the MFT are lost.
The boot sector says where the MFT starts. The MFT holds one record per file or folder, and each record says where that file's contents are in the data area, possibly in several pieces (fragments). Each folder also keeps a sorted list of its contents in INDX blocks, so names are written in two places.
A record stores its folder only as a number. To show "Photos\2024\beach.jpg", the folder's own record must be readable too. If it isn't, the file is fine but has lost its place. That's why DiskSalvor can show "Lost folder #N" and then try to restore the real folder names from the INDX blocks (deep search).
Other system files: $LogFile (a journal of changes in progress, replayed at mount), $Bitmap (which clusters are in use), $UpCase, $Secure (permissions), $Extend\$UsnJrnl (a log of recent changes), and the MFT's own bitmap.
DiskSalvor is free, open-source data recovery for failing drives on Windows. It never writes to the drive, gets the easy files off first, goes back for the rest round by round, and explains what it's doing in plain English. No file limits, no paid edition, no account.
Common situations: what to doDrive asks to be formatted, isn't detected, shows 0 bytes, clicks or is very slow: the most likely cause of each, and what to do first.
When the file index is damagedWhy a drive turns RAW after a power cut or unplug, why your files are usually still there, and how they're recovered.
Bad sectors, retries and hangsWhat a bad sector is, why one bad spot can freeze Windows for minutes, and how to read a failing drive without making it worse.
The drive's health log (S.M.A.R.T.)What S.M.A.R.T. values like reallocated and pending sectors mean, why a failing drive can still say 'passed', and which numbers matter.
How the safe copy worksWhy copying a failing drive once, easy parts first, protects your files, and how an image lets you recover from the copy instead.
What can be fixed, and whenBoot sector, partition table, file index, bad sectors: what can be repaired, and why repairs should wait until your files are safe.
The big picture: a drive is a stack of layersFrom numbered sectors to partitions, file systems and your files: the layers of any drive, and why 'format the disk' usually means one is damaged.
Kinds of drivesWhat's inside each kind of drive, how each usually fails, whether deleted files can come back, and whether it keeps a health log.
How a drive connects, and why it mattersWhy the same disk behaves differently in different USB enclosures, and what bridges and card readers mean for recovering data.
Inside: platters vs flashHow hard disks and flash drives store data, why disk order matters on a hard drive, and why deleted data on an SSD is usually gone.
Sectors, LBAs and clustersThe smallest units a drive and a file system work in: sectors, 512e and 4Kn, logical block addresses and clusters.
Partition tables: MBR and GPTWhat MBR and GPT partition tables hold, which one has a backup copy, and why a USB stick with no partition table is normal.
File systems comparedWhere each file system is used, how it finds files, what safety features it has, and how good the chances of recovery are.
Inside FAT32 and exFATHow FAT32 and exFAT store folders and file chains, what deleting changes, and which deleted files come back whole.
What Windows does when you plug in a driveDrivers, Disk Management, indexing and thumbnails: what Windows does to a drive on its own, and how to stop it straining a failing one.
What has a backup copy, and what doesn'tWhich disk structures have backups (GPT, the NTFS boot sector, the MFT mirror) and which don't, so you know what can be rebuilt.
EncryptionHow BitLocker and enclosure encryption affect recovery, where the keys are, and why some WD drives only read through their own USB bridge.
Reference
Where DiskSalvor fitsHow DiskSalvor reads a drive as raw sectors, layer by layer, without writing to it, even when Windows calls the volume RAW.
GlossaryPlain-English meanings of bridge, carving, CHKDSK, LBA, MFT, RAW, S.M.A.R.T., TRIM and other drive and recovery terms.
DiskSalvor