NTFS recovery: getting your folder structure back

NTFS maintains a Master File Table (MFT): one entry per file, holding its name, its parent folder, its timestamps and the exact locations of its data on disk. Deleting a file marks its MFT entry as free — it does not erase it.

That surviving entry is what makes NTFS recovery qualitatively better than recovery on a memory card. Instead of guessing where a file started and ended, the recovery reads exactly where it was, and reads its name too. In practice that means deleted files come back as the-document-i-lost.docx in Projects\2026\, not as file0134.docx in a flat heap.

In RecoverHelper, Quick Scan is the NTFS-aware mode. It reads the MFT and reconstructs deleted files with their original names, folder paths and timestamps, and it typically finishes in under a minute even on a large drive, because it is reading a table rather than sweeping the whole disk.

Run it first whenever the drive is NTFS and the loss was a normal delete, an emptied Recycle Bin or a Shift+Delete. If it finds what you need, you are done in a minute and everything is properly named.

Two situations call for more than Quick Scan:

• The drive was formatted. A format writes a fresh, empty MFT. The old entries are gone even though the file data is not, so recovery has to fall back to signature carving — that is Deep Scan, which runs the Quick Scan and then carves the whole volume.
• The MFT entry was reused. NTFS recycles entries for new files. If a lot has been written since the deletion, the record for your file may have been claimed by another. The data may still be carvable; the name will not come back.

Both are strong arguments for scanning early rather than after a week of normal use.

RecoverHelper's Mac version reads NTFS volumes the same way — so an external drive formatted for Windows still gives you original filenames when scanned from a Mac.

The Mac's own disks are a different matter: APFS and HFS+ volumes are recovered by signature, meaning the file contents come back but the original names do not. That is a property of how those file systems are read, not a limitation you can configure around.

JPG and PNG recover for free. Documents, RAW, video, audio and archives unlock for free once you pair the free RecoverHelper mobile app.