File System Issues and Compatibility
Problems
and Solutions with lost files*
A file found by the help of a file signature search algorithm is called 'lost'. These files can be found on drives without any file system data like directories (detected drives will be named as 'RawFS') or on a single drive after performing the Find Lost Data process (shown in 'Other Lost'). Typically, these type of files can only be recoverd, if they are stored in one or consecutive clusters on the drive.
If the file size of these lost files could not be detected, they will have the default size specified under menu "Object/Options/Scan options". The default size maybe too small for the detected file, e.g. if a bitmap file could be detected but the image is cut off at a position. In this case the size of the found lost file is too small and you can adjust the size for each single file by selecting Properties from Object menu. It does not matter if you specify a size above the real size of the file since most file types store their own correct size in the file.Another problem can occurs if the found file is using an OLE Storage Format that is used by most new file formats like recent versions of Microsoft Word, Excel, PowerPoint and many third vendors. In this case FILERECOVERY tries to detect the correct extension and rename the extension (e.g. to .DOC, .XLS or .PPT). If that fails the file extension will remain '.MOF'.
In Windows® 2000/XP (all versions), whenever an entry (file or folder) is deleted the higher order word of the 32-bit starting cluster is erased by the operating system. Hence the correct value of the starting cluster at the time of recovering the entry is not known. Without the exact knowledge of the starting cluster no recovery tool can find out and successfully undelete a deleted entry. To overcome this problem FILERECOVERY has devised a solution. Depending on the size of the disk, it generates probable starting cluster values of the file/ folder selected for undelete . In case of a folder the program will automatically try all multiple combinations which may result in a delay during reading process - in case of a file it will ask the user to test each of the multiple combinations.
To decide if the file has been recovered you should open it with the software program applicable to the type of the file recovered - if the application cannot open the file you should let FILERECOVERY continue with the next combination until the test succeeds.
If the drive's cluster size exceeds a certain cluster count (depending of the size of the disk), there are too many possible combinations (> 256) and this feature will be limited to this certain cluster count.
It has been seen that the file system driver in the case of NTFS drives tries to optimize the space used by the MFT by resizing it during each time the system is switched on. Once the MFT has been resized (if downsized), it is not possible to recover all the deleted entries.
For best results, it is advisable to run FILERECOVERY in the same session the files were deleted.
Deleted
files from Recycle Bin under Windows NT/2000/XP
When a file is sent to the Recycle Bin under Windows NT-based operating system, the file name is no longer preserved. The files will be renamed into 'D drive letter deleted file#'.
When recovering files that have been removed from the recycle bin (folder 'RECYCLER') look for 'D' followed the drive letter of the original file, followed by a number. For example, a file deleted from the E: drive may be named 'DE10.DOC', a deleted file from C: drive may be named 'DC.XLS'. The file extensions will be preserved as well as the deleted date. This rule does not apply to files which have been deleted from The Command Prompt or from within applications, they will retain their file names.
NTFS encrypted
and compressed files
When saving compressed files, guarantee that you are using a Windows® NT-based operating system that supports compression (Windows® 2000/XP). Otherwise the compressed files can not be decompressed and will be saved in a compressed format using the extension '.$compressed'. Files with this extension can be imported later under NT-based operating system uisng the additional FILERECOVERY tool 'comimport.exe'.
When saving encrypted files, guarantee that you are using a Windows® NT-based operating system that supports encryption (Windows® 2000/XP) and save the recovered data to a NTFS drive. Otherwise the encrypted file can not be decrypted and will be saved in a packed raw encrypted format using the extension '.$efs'. Files with this extension can be imported later to a NTFS drive using the additional FILERECOVERY tool 'efsimport.exe'.
If you have recovered an encrypted file of a user whose account is no longer available or who loses his private key (e.g. due to a system crash) you may use one of the following solutions to read the data again:
- Use the Windows® NT Certificates snap-in to import the user's Certificate to read the file. This presupposes that you have exported the user's certificate before.
- Recover the file as Recovery Agent (encrypted files are encrypted with the user's key and a Recovery Agent's key, a delegated person whose account is configured as Recovery Agent).
The recovery agent can go to the machine with the encrypted file and load his recovery certificate and private key and perform the recovery on the machine.
NOTE: In a small business or home environment where there are no recovery agents, recovery can be done on a stand-alone computer itself using the local administrator account, which is configured as the default recovery agent.- Back up your encrypted files (using Microsoft Backup) to a .bkf file and send the .bkf file to the Recovery Agent's computer. The Recovery Agent should restore the files on a secured system, decrypt them and send them back to the user.
Refer to your Windows® operating system manual to get more information on decrypting encrypted (encryption recovery) files that have been saved to a NTFS drive.
FILERECOVERY is compatible with all Windows® file systems. There may be some problems with the way FILERECOVERY accesses the disk and some anti - virus tools may report an error. For best usage, uninstall any anti - virus tools before running FILERECOVERY.
Once FILERECOVERY has scanned a drive, the user will find a large number of folders named "New Folder" or "New Folder (2)" and so on. These folders are generally created when the user creates a new folder from the Windows® Explorer. The following things happen at the disk level when the user creates a new folder through the Windows® Explorer.
1) A folder named "New Folder" is created in the path chosen by the user.
2) After the user renames it, the "New Folder" gets deleted and the renamed folder name is entered in the disk.
Since FILERECOVERY can in no way distinguish whether the "New Folder" is a valid folder or just the initial name of a folder that the user has subsequently renamed, it will show all the "New Folders" as deleted.
* applies only to FILERECOVERY Professional Edition
FILERECOVERY
is a registered trademark of LC Technology International, Inc
Microsoft
and Windows are trademarks of Microsoft Corporation. All other trademarks are
the property of their respective owners.