How Windows filesystems are organized and
what this means for data recovery
A filesystem is a method of organizing and storing files on a disk
(hard drive, SSD, USB flash drive, etc.).
You can think of it as a book's table of contents or a library catalog.
Imagine a huge library without a catalog. In that case, we just have a pile of books thrown
haphazardly on the floor. To find the one we need, we'd have to sift through everything.
And how would you even know if the book exists at all? No way.
Now imagine a library with a catalog: every book has a number on its spine.
The catalog says: "The book 'Stream of Thoughts' – on the third shelf, second row."
And you can find it in seconds without any trouble.
The filesystem is that very catalog. It knows:
- where each file is located (on which disk sectors);
- what it's called;
- how large it is;
- when it was created or modified;
- who can open or modify it.
But beyond defining how data is stored on the media, each file system has its own methods
for deleting files and formatting the media.
This is precisely why the success of data recovery depends very much not on the media itself,
but on which file system was used on it.
Windows Filesystems
In the Windows world, there are several file systems, each with its own history,
strengths, and limitations.
Some are designed for everyday work (NTFS), others for large servers (ReFS),
and still others for the flash drives you carry in your pocket (FAT and exFAT).
Let's take a closer look at each of them from a data recovery perspective.
FAT/FAT32
A disk in FAT/FAT32 is divided into equal-sized chunks called clusters.
Each file occupies one or more of these chunks.
They don't have to be located next to each other – the beginning of a file might be in one place,
the middle in another, and the end in a third.
Such a file, scattered across the disk, is called fragmented.
The FAT file system uses a File Allocation Table (FAT) – this acts like a map.
It shows which clusters are in use, which are free, and in what order the pieces of a file are
linked together. Just in case, the table is stored in two copies –
at the beginning and at the end of the disk. FAT also has a concept called the root directory –
this is a list of all files and folders in the root of the disk. For each file, it records:
the name, size, starting cluster, and other information.
What happens when a file is deleted
When you delete a file, the system:
- marks the file's entry in the root directory as deleted (the first letter of the name is replaced);
- marks all its clusters as free in the FAT.
The cluster chain is broken – the system no longer knows how the file's pieces are connected.
Recovering deleted files
- If the file was not fragmented (stored contiguously),
it's easy to recover: the name, size, and starting cluster are preserved.
The chance is almost 100%.
- If the file was fragmented, it's more difficult.
We only know the beginning of the file; the rest of the pieces are lost.
We can try to guess their locations, but that doesn't always work.
ReclaiMe data recovery software has algorithms for guessing, but here the guarantee is
far from 100 percent.
exFAT
exFAT came to replace FAT/FAT32 and is very similar to them in many ways.
This file system has the same structure and the same operating principle.
It also has a table, but it is used only to track the order in which the pieces of fragmented
files are connected. The only difference is that exFAT stores only one copy of this table,
not two, as in FAT32.
ReFS
ReFS is structured differently from other Windows file systems.
Instead of tables, it uses a tree-like structure.
This tree helps to quickly find any files and folders.
Almost everything in this system – both the files themselves and the metadata – is stored as such trees.
Folders and files in ReFS are also parts of the tree. Everything is organized and interconnected.
Key feature: Copy-on-write
When you modify or delete a file, the system does not touch the old data. Instead, it:
- copies the data;
- makes changes to the copy;
- writes the new version to a different location;
- and only then replaces the old data with the new one.
The original information remains untouched until the very last moment.
File recovery
Since the system does not overwrite old data immediately but keeps their copies,
recovering a file is quite easy. As long as the old data hasn't been overwritten
by something new, the chance of full recovery is almost 100%.
NTFS
NTFS has a master table – the MFT (Master File Table).
It's something like a card index, where each file and folder has its own record card.
The card contains everything: the file name, size, creation date, where it is
located on the disk, and other information.
The table also has a special marker – a bitmap – that shows which MFT records
are in use and which are free.
Small files are stored directly inside the MFT record.
This is fast and convenient. Larger files, however, are stored separately,
and the record only contains a reference to where they are located.
The same applies to attributes of large files – they can also be stored externally.
Folders in NTFS are also special files.
They store a list of all files and subfolders, along with references to their MFT records.
In addition to the bitmap inside the MFT, NTFS has a separate bitmap file for the entire disk.
It shows which areas of the disk are occupied by data and which are free.
What happens when a file is deleted
When a file is deleted:
- its MFT record is not erased but simply marked as "free";
- the space on the disk where the file was located is marked as free in the overall disk bitmap;
- the file's entry disappears from the folder.
At the same time, the record itself, with the name, size, and address of the file, still exists.
File recovery
Since all the information about the file (name, size, and where it was located) remains in the MFT record,
recovering it is relatively easy.
If the data has not been overwritten by new files, the chance of full recovery is almost 100%.
The list of useful links
FAT recovery
NTFS recovery
ReFS recovery