MRT Data Recovery

Purpose & User Intent: The MRT Data Recovery tool addresses accidental deletion, partition corruption, and missing or damaged files across consumer and professional storage environments. Target users include IT technicians, forensic practitioners, system administrators, and power users who require reliable restoration without OS repair or hardware replacement. When data loss occurs due to user error, crash, or physical drive issues, the tool provides guided, non-destructive scanning and selective recovery based on a transparent domain rule set, enabling audit-ready recovery workflows.
Core Logic & Features: Core capabilities include quick and deep scans, signature-based carving, and metadata reconstruction across NTFS, exFAT, HFS+, ext4, and other common file systems. Required features: device selection, scan mode, and destination; optional features: disk image capture for offline analysis, sector-level previews, hash verification, RAID layout reconstruction, file-type filtering, and export manifests for auditing and compliance.
Inputs & Outputs: Inputs include source_path (string, required; sample '/dev/sdb1'), scan_mode (enum: 'quick','deep', required; sample 'deep'), file_filters (array, optional; sample ['jpg','pdf','doc']), recovery_destination (string, required; sample '/recovery'), imaging_parameters (string|object, optional), and optional write-protection checks (boolean, optional). Outputs include recovered_items_count (integer; unit: files), total_recovered_size (integer; unit: bytes), items (array of {path:string, size:int, mime:string, hash:string|null, status:string}), preview_available (boolean), time_taken_seconds (float), and report_format (string; allowed: 'CSV','JSON','ZIP').
Algorithms & Calculations, Error & Edge Cases, Localization & Assumptions: The tool uses sector-level reads, file-signature carving, and directory metadata reconstruction with hashing for integrity verification; RAID-aware reconstruction is attempted via metadata correlation. It handles unreadable sectors, encrypted volumes with limited visibility, damaged MFTs, and inconsistent partitions, signaling unrecoverable regions with confidence scores and offering non-destructive previews. Localization supports UTF-8 filenames and locale-aware timestamps; assumes authorized access and does not perform OS repair or hardware fixes. Exclusions include decryption bypass, firmware repair, and guaranteed restoration on severely damaged media; recommended follow-up with physical drive service when hardware failure is suspected.