NTFS Recovery: MFT Records, Update Sequence and Runlists
NTFS keeps a record per file in the Master File Table, including where its data lives. Most recovery starts there.
MFT and runlists
Each record holds attributes: name, timestamps, size, and a runlist of clusters. Update sequence arrays protect records from torn writes. Damaged MFT entries can often be rebuilt from mirror records or from the $LogFile.
When it is RAW
'RAW' means Windows cannot parse the filesystem, not that the data is gone. Rebuild the boot sector and MFT from copies, or scan for record signatures, always on an image.
FAQ
Does chkdsk help?
It can repair metadata but may discard orphaned data. Image first, and prefer targeted repairs.
Are deleted files recoverable?
Often, until clusters are reused; NTFS does not zero the data.