Comprehensive search method allows you to find and virtually rebuild the directory structure of a damaged file system or to find lost files of known types by signatures if a file system can not be used.
If a file system is not seriously damaged then the volume can be opened before the scan completes. When choosing a volume, you can be guided by quality indicators and other parameters (details are below).
Before working with special types of storages (striped volumes / RAIDs, encrypted storages, disk images), refer to the appropriate instructions (in the section Open Volume), otherwise Full Scan will give incorrect FS results if you simply run on individual source disks. For regular partition, it is recommended to open a physical device and scan the entire area the partition may occupy (including previous and new locations) rather than trying to work with the damaged logical disk. The software may read beyond the selected area if it is necessary.
Different volume variants may be given for the same volume which are usefull in the most complex cases only (such as interrupted FS transformation: move / split / merge / resize / cluster resize, or for spanned volumes). In such cases some files can be recovered correctly from one volume variant, and others from another one, despite the same files might be visible on both volume variants. Open the selected variant as a volume and recover files. If files are missing or being recovered incorrectly you should continue the scan or try another variant.
| Open volume | Open volume selected in the list. |
|---|---|
| Save... | Save search log to a file. |
| Load... | Load search log from a file (to continue previous search or to use previous search results). |
| Start/Stop | Start/stop scan. If scan parameters are not changed the scan will be continued. |
| Parameters |
Select scan area, FS, parameters to gather data and calculate volumes. Jumping scan is used when it is necessary to faster find the main results over the entire disk without waiting the scan completes. Jumping scan is carried out selectively over the entire disk gradually covering the entire scan area. Volumes with the large number of files are being found first. |
| Log-file | Options to save the scan state and results automatically to a file |
| Menu | Besides, allows changing volume sorting order. |
The columns % and Check allow preliminary estimating data recovery quality of a found volume variant (the percentage and number of correct interconnections between FS structures and files found by signatures for NTFS, exFAT, HFS; and for other file systems only FS structures are checked).
Min. Size is the minimum size estimate of the area occupied by the volume files (only the best found FS fragments are taken into account).
The column Indicators shows the absence (damage) ("-") or presence ("+") of the corresponding FS structures (B/C - boot sector/copy; for FAT: F - FAT table/copy, R - root directory).
File signatures are used as a last resort to find lost files when recovery by file systems (above) is not possible. Additionally file signatures are used to improve and control the quality for NTFS, exFAT, HFS search. They are also used to mark and filter files found both by a file system and by signatures, that is files with a high probability of recovery (see File Panel icons).
Raw results are available under the directory $Raw in the file panel when any volume is opened. To exclude results found by a file system of an opened volume, you can use the symbolic directory $Raw - Filter Raw Results (cluster map features are used to determine and exclude the space occupied by files).
Normally there are no reasons to open Raw results individually when there are FS results. Raw recovery is possible only for files which have special signatures. Raw recovery does not work properly for fragmented files (only the first file fragment is recovered correctly). Raw recovery does not provide original file names and directory structure. Raw recovery does not always allow detecting original file sizes. If there is neither end file signature nor built-in size info for a given file type then it is assumed a file continues until the next found signature, so searching for all present file types may improve size detection.
For some built-in file types, consecutive fragments can be combined into one file, so the number of files in the file panel may be less than in the scan results.
Raw: File Signatures: select file types for search, add new file signatures.
File Signature is a fixed sequence of bytes at the file beginning for the certain file type. E.g. if you open any PDF file in a hex editor you can see the same sequence of the first 4 bytes:
If the signature position in a file is not fixed then minimum and maximum offsets must be specified. Entire signature must fit in the first 4096 bytes.
In addition to built-in file types and corresponding signatures, it is possible to add new types by the user (only if these types have unique signatures): Full Scan (Parameters) - Raw: File Signatures - Add.
In simple cases, it is possible to automatically calculate the signature of a new type on the base of sample files. You should push the button "..." and specify possible extenstions (comma separated) and the path where working files of the necessary type are located. If the recovery is being made from the camera, you can take a different photo / video to the new media in the same format to obtain sample files.
The Test button allows you to check the signatures on a specific file and find out whether files of this type are defined correctly.
The option use for FS calculation
enables checking interconnections between FS structures and files found by the signature.
Additionally the files in the FS will be marked in a File Panel
as found also by a signature (or not found).
Multiple comma separated Extensions can be specified for FS calculation.
Mark signature as reliable if it contains at least 4 different bytes at a fixed position
(do not mark otherwise not to truncate other files if false positives happen).
File-container may contain other file types inside
(mark in order not to truncate when other type files are met).
EOF Signature is an optional signature at the end of a file.