Guessing Partition Info

scrounge-ntfs needs certain pieces of information to retrieve data from your NTFS partition reliably. The most important are the start and end sector of the partition.

In some cases your hard drive might be so corrupted that this info can't be read of the disk, or you may have overwritten it by reformatting the drive. If that's the case then read through this document carefully. There's a chance you can guess at the needed info:

Start and End Sectors

A hard disk is divided up into sectors. A sector is always 512 bytes in length. The first sector on a Windows formatted PC hard drive usually starts at 63. If you only have one hard disk you or want to recover the first partition on the hard drive you can usually use the following as your start and end sectors.

Start sector: 63
End sector: <drive size in MB> x 2048

If you think you might be guessing the drive size in MB wrong, then it's better to estimate a little higher. A slightly high end sector value won't screw things up.

Cluster Size

NTFS writes data to the hard disk in blocks. On very large hard drives the blocks are larger to allow for more efficient access to the disk. For most drives the cluster size is usually 8. The size will always be a multiple of 2. You can try the values below and see which one works, but start with 8, as it's the most common.

2
4
8
16
32
64

MFT Offset

The MFT is an important file which contains pointers to all the other files. It also contains the directory structure of your disk. You can leave out this value when recovering your data, in which case scrounge-ntfs will run through your entire hard disk locating retrievable files. Everything will be dumped in one directory however.

Depending on which OS you formatted your hard disk with, the MFT is usually located at these locations:

Windows NT, Windows 2000: 32
Windows XP: 6291456
   [ scrounge | home page ]