I need some files recovered from a NTFS partition with MFT overwritten partially.
The NTFS file was created by windows 10 installer with default options. It was primary partition.
I have recovered logins.json which stores saved passwords in Mozilla Firefox which looked fine when opened with text editor. I have recovered many key4.db files which contains decryption key for the logins.json entries. Sadly, None of the keys.db matched the logins.json I recovered when I placed in Firefox Profiles directory. I have already recovered all the SQLite files that Photorec could find from the physical sectors where the partition should be located.
Questions
- I want to know if it is possible to read the partial MFT and find the files I want from that.
- Can you also suggest me some Recovery tools?
