Andrea Lazzarotto

Currently there is no option for this, but it's a useful request.

To clarify, currently RecuperaBit is not "chosing" any size, it is set as a constant equal to 512. 😅

What we are concerned with is the sector size used by the file system, not by the physical disk. If the logical size is 512, you should be OK.

That would be really useful, although I haven't found a lot of information about how NTFS does it. Do you have any reference? Maybe we shall look at the source...

> Or is the $STANDARD_INFORMATION simply ignored? I need to check to be fair, but IIRC that's correct. > dump all found attributes for inode somehow Do you mean like...

You can usually extract the `$MFT` file itself, unless the metadata is heavily damaged.

Thank you for the detailed test and the script you provided. I will check it out. Just one thing, what do you mean by this? > Additionally unixtime is output...

Can you clarify what you mean by "valid size"?

OK. But why would we want to hide those? There are partitions with thousands of recoverable files for which simply there is no boot sector (and backup), so we don't...

Just to clarify: > my disk that had first 1.4MB overwritten If you overwrite the first sector of the specific partition you are looking for, then you already find yourself...