How to undelete files "in place"? Recover NTFS entry on orig.partitio

[pstein]

How to undelete files "in place"? Recover NTFS entry on orig.partitio

Normally if a user accidentially deletes a file and want to recover it then he can take the following steps:
Load one of the many "undelete" tools (like Recuva) and let it detect,analyze and copy the file to another partition.

Now assume that the partition where the deleted files is stored has no traffic (= nothing more is stored there).

So instead of copying the whole file to another partition it should be possible to recover it "in place".
That means a smart undelete-tool should be able just to re-create the previously deleted NTFS entries of the file and the sector chain on the original partition without having to perform a full copy operation..

All information is available.

Unfortunately I did not found such a smart undelete tool .
All of them require a lengthy copy-operation.

Why?

Maybe there is such a tool and I miss it.
Can someone give me a recommendation.

Thank you
Peter

 

[LMiller7]

There are programs that claim to be able to do an in place undelete but I am not sure any are free. Recovery by copy is a lot safer because it doesn't alter the original data. If anything goes wrong with the in place recovery you could end up making things worse. NTFS is a complex proprietary file system and many of the details have never been publicly documented. An in place recovery is highly problematic in recent versions of Windows. This would require direct writes to the drive and the NTFS file system really dislikes writes taking place without it's knowledge. This is usually not permitted with recent versions of Windows.

Most developers would consider an in place recovery too dangerous. With modern technology things are often (usually) more complex than they appear.