Could anyone please help me with a disk I've been working on recovering for years. It contains a previously compressed NTFS partition with a completely missing MFT so there isn't a single trace of the compression information. The data lost was a Microsoft Backup file - which thankfully marks each archived file with a FILE header.

I have decided to splice the data myself into identifiable files (identifiable by the "FILE" at the start of the compressed block).

Is there any way to harness the decompression ability of this driver to forcefully decompress a block of raw data? (note, I'm good with scripts, but I'm not able to follow the code in the compress.c source).

Anyone any idea?

Hi,


In a compressed file, each block of 4K is compressed independently, so you should be able to interpret its contents. However if cluster size were smaller than 4K the blocks might be non-contiguous.
Now, to locate the beginning of a block, you have to search for a pattern 0xbn (>= 0xb0 and <= 0xbf) in the second byte of a cluster.

When you get such a block, you can decompress it by applying the function ntfs_decompress() from compress.c

Regards

Jean-Pierre