NTFS directory-index recovery
NTFS directories use indexed attributes commonly named $I30 to organize file-name entries. Damage can make a folder unreadable, empty, or cyclic even when the Master File Table still contains valid records for many children.
Understand the symptom
An MFT record stores file attributes and file-name links, while a directory's $I30 index organizes children for lookup. Recovery compares index root and allocation records, MFT file-name attributes, sequence numbers, parent references, $LogFile, USN journal, and data runs to rebuild paths without trusting one damaged tree.
What you may see
CHKDSK identifies inconsistent directory-index entries.
The directory index is unreadable or omits children that still have MFT records.
Traversal fails even though the volume and other folders mount.
Repair reconnected records after losing their original directory relationship.
Protect the source
Entries that do not satisfy consistency rules may be discarded or reconnected elsewhere.
A reused MFT record can be linked to an unrelated historical directory entry.
If the volume is slow or unstable, image it before reading every record.
Do this now
Do not run /f, /r, defrag, reset, reinstall, or save files to the affected volume.
Capture paths, screenshots, event IDs, CHKDSK output, and the last known working time.
Preserve the partition and underlying device before index reconstruction.
Identify folders, dates, file types, user profiles, and applications that must retain paths.
NEPFOSYS process
NEPFOSYS correlates $I30, MFT file names, parents, sequence numbers, log records, and allocation state.
Candidate directory relationships are rebuilt on copies with stale records filtered from current ones.
Recovered files are opened or hashed where practical, with original and reconstructed paths clearly reported.
A clear next step
Start a case with the exact symptoms, incident timeline, prior attempts, encryption details, and the files that matter most. NEPFOSYS will route the case to the appropriate DFW intake or nationwide mail-in path.
Start with a case reviewQuestions, answered
It is the conventional name for the indexed attributes NTFS uses to organize entries inside a directory.
No. It may reconnect or delete inconsistent entries to make the filesystem coherent, not preserve every historical name.
Yes. MFT records and data runs may remain readable even when the folder index is damaged.
DFW local · Nationwide mail-in