Understanding NTFS Recovery

NTFS is the most common file system on Windows. When a file is deleted, the MFT record is marked as inactive but the data clusters often remain intact.

How MFT Parsing Works

The Master File Table is a relational database that tracks every file on an NTFS volume. UndoDisk reads MFT entries directly to locate deleted file records.

Journal Replay

NTFS maintains a change journal ($UsnJrnl) that logs every file system operation. By replaying journal entries, UndoDisk can reconstruct the state of files even after significant disk activity.

Recovery Confidence

Each recovered file receives an AI-powered confidence score from 0 to 100%, indicating the likelihood of a complete and intact recovery.