Efficient Recovery of Deleted Data and Metadata from NTFS and ReFS File

Abstract - Data loss resulting from accidental deletion, file system corruption, malware attacks, ransomware incidents, and unexpected system failures continues to present a significant challenge in modern Windows-based computing environments. As digital storage systems increasingly support critical personal, organizational, and enterprise data, the consequences of data loss have become more severe, affecting operational continuity, legal compliance, and forensic investigations. Although numerous data recovery solutions are currently available, the majority of these tools focus primarily on restoring raw file content and often neglect the recovery of associated metadata such as file names, timestamps, directory hierarchy, access permissions, ownership details, and security descriptors. Metadata plays a vital role in preserving contextual accuracy, forensic validity, and auditability of recovered data, particularly in investigative and compliance-driven scenarios. This paper presents a comprehensive metadata-aware recovery framework specifically designed for Windows file systems, namely NTFS and ReFS. The proposed approach leverages file system–specific internal structures, including the Master File Table (MFT) in NTFS and copy-on-write metadata trees in ReFS, to recover deleted files along with their associated metadata. A unified metadata correlation and validation engine is employed to ensure consistency, accuracy, and forensic reliability of recovered records by cross-verifying multiple metadata attributes. The framework operates in a read-only manner to maintain forensic integrity and prevent evidence contamination. Key Terms - NTFS, ReFS, Metadata Recovery, Data Recovery, Digital Forensics, Windows File Systems, Master File Table (MFT), Copy-on-Write, File System Metadata, Integrity Streams.