License Agreement

This document is a legally binding agreement between you and GetData Pty Ltd ABN 79 100 297 149 ("GetData"), the developer of the software program "Recover My Files" ("Software"). Permission to use the Software and any documentation included with the Software ("Documentation") is conditional upon you agreeing to the terms set out below. By installing or otherwise using the Software you agree to be bound by the terms of this agreement. If you do not wish to accept the terms, do not install or use the Software and (if using a CD-ROM) return the Software and Documentation to GetData in its original packaging within 14 days of receiving the Software.

In consideration of the payment by you of the applicable fees, GetData grants to you, and you accept, a non exclusive non-transferable license to use the Software and Documentation . GetData is and remains the exclusive owner of the Software and the Documentation. You acknowledge that copyright in the Software and Documentation remains at all times with GetData. Unauthorized copying or modification of the Software and/or Documentation will entitle GetData to immediately terminate this Agreement. GetData shall have the right to check license details at any time in any reasonable manner.

You may freely distribute the unregistered "trial" version of the Software.

The "Standard License" permits you to install and use the Software on a single computer or, in the event that you have purchased multiple licenses, to install the Software concurrently on multiple computers equivalent to the number of licenses that you have purchased. The standard license does not allow you to use the Software to perform commercial data recovery services for other parties.

The "Professional License" permits you to install and use the software on a single computer or, in the event that you have purchased multiple licenses, to install the Software concurrently on multiple computers equivalent to the number of licenses that you have purchased. The standard license does not allow you to use the Software to perform commercial data recovery services for other parties.

The "Data Recovery Technician" license is provided on a hardware dongle only. It allows the license holder to install the software on a third party computer and activate it with the dongle for the purpose of performing data recovery services.

You are not permitted to share the license, product activation information, or hardware dongle for the Software with other users.

Unless you have purchased multiple licenses, this license does not permit you to load or use the Software on a network server or similar device which permits access by multiple computers

GetData may from time to time revise or update the Software and shall make such revisions or updates available subject to payment of the applicable license fee. Support for the Software is provided at the product web site.

The Software and Documentation is protected under Australian law and international law and international conventions and treaties. You may not rent, lease, sub license, assign or otherwise transfer use of the Software to others without the express written permission of GetData. Doing so will entitle GetData to immediately terminate this Agreement .

Except to the extent applicable law specifically prohibits such restrictions, you may not reverse engineer, reverse compile, disassemble or otherwise modify the Software in any way .

You are solely responsible for protecting yourself, your data, your systems and your hardware used in connection with the Software. GetData will not be liable for any damages suffered from the use of the Software.

BY USING THIS SOFTWARE, YOU EXPRESSLY AGREE THAT ALL RISKS ASSOCIATED WITH THE PERFORMANCE AND QUALITY OF THE SOFTWARE IS ASSUMED SOLELY BY YOU. YOU ACKNOWLEDGE AND AGREE THAT YOU HAVE EXERCISED YOUR INDEPENDENT JUDGEMENT IN ACQUIRING THE SOFTWARE.

TO THE EXTENT PERMITTED BY LAW, GETDATA SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE, EVEN IF GETDATA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE SOFTWARE IS MADE AVAILABLE BY GETDATA "AS IS" AND "WITH ALL FAULTS". TO THE EXTENT PERMITTED BY LAW, GETDATA DOES NOT MAKE ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, CONCERNING THE QUALITY, SAFETY OR SUITABILITY OF THE SOFTWARE, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT OR THAT THE SOFTWARE IS ERROR FREE .

IF ANY CONDITION OR WARRANTY IS IMPLIED INTO THIS AGREEMENT UNDER ANY APPLICABLE LEGISLATION CANNOT BE EXCLUDED, OR IF NOTWITHSTANDING THE EXCLUSION OF LIABILITY ABOVE GETDATA IS OTHERWISE LIABLE TO YOU, THEN TO THE EXTENT PERMITTED BY LAW THE LIABILITY OF GETDATA FOR BREACH OF THE CONDITION OR WARRANTY WILL BE LIMITED TO ONE OR MORE OF THE FOLLOWING AS DETERMINED BY GETDATA IN ITS ABSOLUTE DISCRETION:

(i) IN THE CASE OF GOODS, (A) THE REPLACEMENT OR SUPPLY OF EQUIVALENT GOODS OR THE REPAIR OF THE GOODS; OR (B) THE PAYMENT OF THE COST OF REPLACING THE GOODS, ACQUIRING EQUIVALENT GOODS, OR HAVING THE GOODS REPAIRED; AND
(ii) IN THE CASE OF SERVICES, THE SUPPLYING OF THE SERVICES AGAIN OR THE PAYMENT OF THE COST OF HAVING THE SERVICES SUPPLIED AGAIN.

This agreement cannot be changed or altered except by a written document signed by you and GetData. This agreement is governed by the laws in force in New South Wales, Australia. Each party irrevocably and unconditionally submits to the non-exclusive jurisdiction of the courts of New South Wales, Australia.

Disclaimer

The software available for downloading through Internet sites and published by GetData (the "Software") is provided pursuant to this license agreement. GetData encourages you to know the possible risks involved in the download and use of the Software from the Internet. You are solely responsible for protecting yourself, your data, your systems and your hardware used in connection with this software. GetData will not be liable for any damages suffered from the use of the Software.

BY USING THIS SOFTWARE, YOU EXPRESSLY AGREE THAT ALL RISKS ASSOCIATED WITH THE PERFORMANCE AND QUALITY OF THE SOFTWARE IS ASSUMED SOLELY BY YOU. GETDATA SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OF OR INABILITY TO USE THE SOFTWARE, EVEN IF GETDATA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE SOFTWARE IS MADE AVAILABLE BY GETDATA "AS IS" AND "WITH ALL FAULTS". GETDATA DOES NOT MAKE ANY REPRESENTATIONS OR WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED, CONCERNING THE QUALITY, SAFETY OR SUITABILITY OF THE SOFTWARE, INCLUDING WITHOUT LIMITATION ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. FURTHER, GETDATA MAKES NO REPRESENTATIONS OR WARRANTIES AS TO THE TRUTH, ACCURACY OR COMPLETENESS OF ANY INFORMATION, STATEMENTS OR MATERIALS CONCERNING THE SOFTWARE THAT IS CONTAINED IN GETDATA'S SOFTWARE DOWNLOAD SITE. IN NO EVENT WILL GETDATA BE LIABLE FOR ANY INDIRECT, PUNITIVE, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES HOWEVER THEY MAY ARISE AND EVEN IF GETDATA HAS BEEN PREVIOUSLY ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

--------------------------------------------------------------------------------

© Copyright GetData 2009

Data Recovery Software | www.recovermyfiles.com


Introducing Recover My Files

Introducing:

Professional data recovery software for:

  • Deleted Files;

  • Lost Files;

  • Formatted Disks;

  • RAW Disks;

  • Missing Drive Letters;

  • Windows Reinstalls.

Safe, secure and reliable. Designed specifically to allow home and business users to quickly and simply recover data. Simple to use, with a full file preview window for recovered files.

Drive Recover Search Results Screen

Recover My Files is the perfect recovery tool for:

  • hard drives

  • usb drives

  • external storage units

  • digital camera storage media

  • CDs and DVDs

Recover My Files V4 supports recovery from a wide range of Filesystems:

  • FAT16 - an early version of the FAT Filesystem, now rarely used

  • FAT32 - common for external storage media and digital camera equipment

  • exFAT - (Extended File Allocation Table), a proprietary file system suited especially for flash drives

  • GPT - GUID Partition Table, a standard for the layout of the partition table on a physical hard disk

  • NTFS - Standard files system for Windows Vista, Windows 7

  • CDFS - CD/DVD file systems (Coming Soon)

  • MAC - HFS (Coming Soon)

  • EXT2 - Linux (Coming Soon)

  • RAID - RAID JBOD, 0, 1, 5, hardware and software


Installing Recover My Files

Important

If you have suffered a data loss, you should, if possible, avoid writing new data to the storage media on which the files were lost. When new data is written to a storage media, it can overwrite and destroy deleted files so that they can no longer be recovered.

Avoid installing new programs, saving new files, or if it is digital camera media taking new photographs or video until you have had the opportunity to attempt data recovery.

Where Should I Install Recover My Files?

The best methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to install your data recovery software on the C: drive of the 'good' computer, and then scan the secondary 'problem' drive to recover your files. This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this PC. If this is the case, limit your use of the computer until you have the opportunity to search for your deleted files.

Recover My Files is a small program (approximately 10mb), so installation of the program onto the problem drive, whilst not recommended, is a small risk.

Minimum Installation Requirements

Recover My Files has the following minimum installation requirements:

  • Install and run Recover My Files with Administrator rights. This is required to obtain low level recovery access to the drive.

  • Windows 95, 98, ME, NT, 2000, XP, 2003, Vista, 2007

  • 10 megabytes of disk space

  • 128 megabytes of RAM

  • Files can only be saved to an alternate drive or directly to a CD or DVD, and cannot be saved onto the same drive from where they are being recovered . This can be another partition on your existing hard drive, another hard drive, USB drive, network drive, server volume, writeable CD or DVD etc.

Internet Download - Installation

Recover My Files can be downloaded from the Internet at www.RecoverMyFiles.com. The installation file downloaded from the Internet is called "RecoverMyFiles-Setup.exe". Run this program and follow the installation wizard.

Installing from CD

Insert the Recover My Files CD into you computer, select the option to install Recover My Files and follow the on screen instructions. Once you have installed from CD, press the "Update" button to download the latest version.

Program Activation

Activation details needs to be entered into the program to activate the ability to save recovered files. To learn how to activate Recover My Files, click here.

What version number do I have installed?

To find this information, at the top of the main program screen in text menu items "File | Recover | Help", click on "Help > About". This will open the program About Box which contains the information.

Upgrade from Recover My Files v3 to Recover My Files v4

A discounted cost applies for existing Recover My Files version 3 customers to upgrade to Recover My Files version 4. Existing version 3 customers:

  • log into your GetData customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com).

    Login: [the email address used in your purchase]
    Password: [if you do not know your password, use the "send me my password" link]

  • once logged in, locate a record of your Recover My Files version 3 purchase and click on the version 4 links;

  • you will see the discounted upgrade price in the shopping cart;

  • checkout and your Recover My Files version 4 key will be displayed on a web page and also sent to you by email.

To Update to the latest Version of Recover My Files

If you are upgrading to the latest version of Recover My Files there is no need to un-install previous versions. Either download and install the latest version from www.recovermyfiles.com or run the program and click the "Update" button in the toolbar of the main program screen (an internet connection is required):

Updates to Recover My Files version 4 are free for the life of this version.

A discounted update cost will apply to exiting customers who purchase the next major version, i.e. Version 5, when it is released.

Un-Install

To un-install the Recover My Files, go to the Windows Control Panel and select "Add/Remove Programs".


How to Activate Recover My Files

Recover My Files Data Recovery Software | English V4
___________________________________________________

Licensing

Evaluation Version v's Activated Version

The Recover My Files software available for download from www.recovermyfiles.com is the FULL VERSION. Product activation details are entered into the program to activate the ability to save recovered files.

We strongly recommend that you run Recover My Files in evaluation mode first. If you find your files, purchase a product activate key and save your files. You do not need to download the software again. You do not need to run the search a second time.

Types of License

Supports | Recover My Files Standard $69.95 | Recover My Files Professional $99.95 | Recover My Files Data Recovery Technician $299.95
FAT 32 |  |  |
EX FAT |  |  |
NTFS |  |  |
HFS (MAC) Coming Soon |  | Coming soon | Coming soon
EXT2 (Linux) Coming Soon |  | Coming soon | Coming soon
CDFS (CD/DVD) Coming Soon |  | Coming soon | Coming soon
Add and Scan Image Files |  |  |
DD |  |  |
EnCase |  |  |
Access Data FTK |  |  |
VMWare |  |  |
SafeBack |  |  |
AFF |  |  |
RAID recovery |  |  |
Software Key Activation * |  |  |
Dongle Activation * |  |  |

* A product activation key is valid for activation on two separate personal computers (e.g. personal desktop and laptop)

* An activation dongle allows the license of Recover My Files to be moved from computer to computer.

Purchasing A Product Activation Key

The [image] button in the program will link directly to the Recover My Files shopping cart. When you click on the button you will receive a message:

to remind you that web access will write files to the C: drive will change its content. If you are recovering files from your current C: drive there is a small risk of overwriting deleted files, so you may wish to make the purchase from another computer.

Your product activation key is displayed on a web page at the end of the purchase process and is also be sent by electronic mail. If there is a delay in your credit card provider authorizing the transaction, your registration key will be provided only by email and only after credit card authorization takes place.

Retail customers will find their product activation key inside the retail box.

Activation dongles a sent by courier. Please allow 5-10 days delivery. Courier tracking information will be provided with your purchase.

Upgrade from Recover My Files v3 to Recover My Files v4

A discounted cost applies for existing Recover My Files version 3 customers to upgrade to Recover My Files version 4. Existing version 3 customers:

  • log into your GetData customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com).

    Login: [the email address used in your purchase]
    Password: [if you do not know your password, use the "send me my password" link]

  • once logged in, locate a record of your Recover My Files version 3 purchase and click on the version 4 links;

  • you will see the discounted upgrade price in the shopping cart;

  • checkout and your Recover My Files version 4 key will be displayed on a web page and also sent to you by email.

Trouble Shooting:

+ Activation: Lost Activation Key

If you have lost your Recover My Files activation key, log into your www.getdata.com customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com) where you can locate a record of your purchase, including your activation details.

Login: [the email address used in your purchase]
Password: [if you do not know your password, use the "send me my password" link]
+ Activation: Max Activations Reached

A single Standard License of Recover My Files can be used to activate the software on two computer systems owned by the purchaser, e.g. a desktop and a laptop computer.

Recover My Files is "hardware locked" to a computer onto which it is installed. Each time the license is used on a new computer (with a different hardware ID) it counts as an additional activation. When the number of available activations is used, the "Max Activations Reached" message is displayed. This is an anti-piracy measure designed to stop a license of the software being unlawfully activated on multiple computers.

You may also receive this message if:

a) you have changed or added new hardware to your existing PC;

b) you have upgraded your computer and reinstalled Recover My Files software.

In this instance, please contact technical support to request additional software activations.
+ Activation: Upgrade from Recover My Files version 3 to version 4

Upgrade from Recover My Files v3 to Recover My Files v4

A discounted cost applies for existing Recover My Files version 3 customers to upgrade to Recover My Files version 4. Existing version 3 customers:

  • log into your GetData customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com).

    Login: [the email address used in your purchase]
    Password: [if you do not know your password, use the "send me my password" link]

  • once logged in, locate a record of your Recover My Files version 3 purchase and click on the version 4 links;

  • you will see the discounted upgrade price in the shopping cart;

  • checkout and your Recover My Files version 4 key will be displayed on a web page and also sent to you by email.


Lost Activation Key

To locate your Recover My Files product activation details

If you have lost your Recover My Files activation key, log into your www.getdata.com customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com) where you can locate a record of your purchase, including your activation details.

Login: [the email address used in your purchase]
Password: [if you do not know your password, use the "send me my password" link]

To contact technical support

Technical support is available by contacting us via the support link at www.recovermyfiles.com. If you need phone support, please be sure to include your contact telephone number where you submit your support ticket.


1. Starting a Recover Files Search

___________________________________________________

The "Recover Files" search

+ Before you begin - Read Quick Start Tips Here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

Running the "Recover Files" search

When the "Start Recovery" button is selected in the Recover My Files v4 program tool bar, two search options are displayed. The first is "Recover Files".

The "Recover Files" options is best used when you hard drive is running correctly, but:

  • individual files have been deleted and emptied from the Windows Recycle Bin;

  • files have been deleted and bypassed the Windows Recycle Bin;

  • files have been deleted by a virus, trojan or worm;

  • a file of the same name has saved over another important file;

  • files have been lost by some other unknown cause.

To search for deleted or lost files, click the "Recover Files" button then "Next" to proceed. (NB: If your data loss problem relates to loss of data from the entire drive, select instead try the "Drive Recovery" option).

Selecting the Drive to Search

In the "Recover Files" mode, Recover My Files will display the "logical drives", i.e. the drive letters. If you do not see the drive letter that you need to scan, click the "Back" button, select the Drive Recovery option, and scan the physical Hard Disk.

It is possible to search only one drive letter at a time. Select the drive to search by clicking it with your mouse, then click the "Next" button to proceed:

Drive Selection:

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ Drive Selection: The drive I wish to search is not listed.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

File Recovery Options

The next wizard window presents the following two search options:

Search for Deleted Files (Recommended)

A Deleted File is a file that has been emptied from the Recycle Bin and marked as deleted by the File System, but which retains sufficient information held in the File System to be recovered.

This search is "Recommended" because:

  • It will rapidly scan the File System for deleted files (the search will take less that 1 hour on a standard home PC);

  • If files were recently deleted, there is a high probability of success;

  • Files located will have their original file names and folder structure intact.

Learn more about finding Deleted Files here.

Searching for Deleted Files

On a computer storage device, the term 'Filesystem' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk, including user deleted files. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

Eventually deleted file entries in the File System will be reused as new data is written to the computer. For this reason, the sooner a search is for deleted files is conducted after a deletion, the greater the chance of a recovery using this technique.

When a file has been found with its original file name, it has been found by locating a File System record for that file which points to the location of the file data on the disk. In a successful recovery, it should be possible to click on the file found in the results window and preview its content, or save the file and open it normally. If the recovered file does not contain valid data, the possible reasons are:

  1. The file system record is pointing to the correct location on the disk, but that section of the disk has been over-written with new data and no longer contains the correct data for this file. In this case, nothing can be done as the original file has been overwritten and destroyed; or

  2. The file system record is corrupt and no longer points to the correct location on the disk. In this case, the additional search for the Lost Files type will attempt to locate the file by its file structure. If the "Search for deleted files, then search for "Lost File" types" option does not locate the file, run a "Lost File" search over the entire drive, by clicking Options > Advanced > and select Start with a Lost File scan and Scan for lost files across the whole device (and not only in the free space)

The steps in the scan as shown in the progress window are:

  1. "Reading Record" - the File System is read;

  2. "Building Directory Structure" - file system records for deleted files are identified and the folder system is created;

  3. "Adding Search Results" - The results are added to the search results screen. Learn more about File Recovery search results here.

Search for Deleted Files, then search for selected Lost File Types

This search first runs the search for Deleted Files, as described above. It then sequentially scans the remaining area of the disk for "Lost Files".

Following a file deletion, subsequent activity on the computer may lead to File System records for these files being destroyed. A "Lost File" is a file that has been deleted which no longer has a File System record (e.g. and entry in the Microsoft FAT or MFT), but the content of the file remains on the disk and can be recovered.

Lost files are located using a technique referred to as "data carving", by searching to find the unique header, structure and footer of the file type. Learn more about searching for Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

It is suggested that this search be run when:

  • The recommended "Search for deleted files" option did not find your files;

  • When you wish to be certain that all possible data on the drive can be located and recovered.

Important: The more file types that are selected, the more resource intensive is these search and the longer the search will take. It is suggested that you do not perform a Lost File search for more than 10 files at any one time.

This is a sequential search of the drive and is indicated in the progress window by "Scanning block xxxxx of xxxxx for lost files":

A sequential search of a large hard drive, e.g. 1TB or more containing many files may take up to 24 hours.

  1. Before you stop the search, write down the block number that the search is up to, e.g. "3,867,514 of 78,126,048";

  2. Press the stop button;

  3. Click the OPTIONS button in the main program screen, go to the ADVANCED tab and place a tick in the box for "prompt for start sector" and "Start with Lost File Scan".

  4. Click OK to save these options, then press "Start Recovery" > "Drive Recovery" and enter the starting location

Recover Files Search Results

Learn about the Recover Files search results screen here.


Drive Recovery - Format

___________________________________________________

Recover Drive

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

+ Before you Begin - Read Quick Start Tips here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

+ When to use the 'Recover Drive' option

The "Recover Drive" options is best used when:

  • a drive has been formatted;

  • a drive has been formatted and windows has been reinstalled;

  • a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;

  • a drive letter has gone missing;

  • the drive is recognized by your PC as RAW and not files can be read;

  • or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

How Recover a Formatted Drive

Run Recover My Files and select "Recover a Drive" and click "Next".

In the example below, and external 75GB USB hard drive containing photos has been accidentally formatted. The drive contained one partition only which was the size of the entire drive. Clicking on the drive letter in Windows Explorer shows that it no longer contains any files.

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

If your hard disk contained 3 separate partitions, e.g. Drives E:, F:, G:, and your formatted only your G: drive, then it would be best to select and search the G: drive only

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

Drive selection problems:

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ Drive Selection: The drive I wish to search is not listed.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Recover Options, Automatic or Selected File Types

The following screen presents two drive recovery options:

"Automatic drive recovery. (Recommended)"

During an automatic drive recovery, certain pre-selected file types are used to assist in locating the missing file system. Recover My Files searches for these file types by locating the header / structure and footer and then uses the information found to help pinpoint the missing file system. These files are called "Lost Files"

In Automatic mode, the pre-selected Lost Files types are Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip files (during an "Automated drive recovery", click on OPTIONS > FILE TYPES to view the pre-selected file type).

Learn more about Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

"Drive recovery using selected file types"

This option allows the user to manually select the file types to assist in locating the missing Filesystem.

It is suggested that you only use this option to change the pre-selected file types if you do not have any of the pre-selected file types on the problem disk. For example, if the problem drive had only HTML files on it, it would be necessary to select the HTML file type.

In most cases the common pre-selected file types will be adequate and additional file type selections will NOT be required to locate the entire file and folder structure containing all files.

You may consider adding it to the list if you have a specific file type that is essential to recover. The benefit of adding a file types is that in addition to helping locate the file system, you are simultaneously searching for the Lost File type by looking for its header, structure and footer. If the file system has been destroyed and cannot be recovered, you may still find the important file as a Lost File. However, be aware that adding file types will slow down the search. We suggest that you do not select more than 10 file types at any time.

I am running a Drive Recovery and the file type I wish to add is not in the list.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

Steps within a Partition Recovery

  • Searching for partitions - a fast search to locate missing partitions on the drive;

  • Reading Record - if partitions are located the information contained in the partitions is read;

  • Building directory structure - the file and folder structure of the partition is analyzed;

  • The layout of the file and folder structure is mapped to the disk;

  • The file and folder structure is displayed in the Recover My Files results screen.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.


Drive Recovery - Format and Reinstalled Windows

___________________________________________________

Recover Drive

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

+ Before you Begin - Read Quick Start Tips here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

+ When to use the 'Recover Drive' option

The "Recover Drive" options is best used when:

  • a drive has been formatted;

  • a drive has been formatted and windows has been reinstalled;

  • a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;

  • a drive letter has gone missing;

  • the drive is recognized by your PC as RAW and not files can be read;

  • or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

A new installation of Windows has lost my files

It is very common to situation for a user to end up with a fresh installation of Windows with the loss of all previous data. Common reasons are:

  • accidentally formatted and reinstalled Windows onto the wrong drive;

  • a system crash left windows inoperable, so Windows was reinstalled on the drive to get the computer up and running again.

Don't panic. In this situation, the majority of data can be recovered.

The new installation of Windows has overwritten some old data on the first part of your drive. However, usually the first part of the drive is where the old Windows installation was so few user created files are harmed.

Important: Avoid installing any new programs on the new installation of Windows - read the "Before you Begin" quick start guide on this page.

How Recover a formatted drive with a new installation of Windows

Run Recover My Files and select "Recover a Drive" and click "Next".

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

If your hard disk contained 3 separate partitions, e.g. Drives E:, F:, G:, and your formatted only your G: drive, then it would be best to select and search the G: drive only

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

Drive selection problems:

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ Drive Selection: The drive I wish to search is not listed.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Recover Options, Automatic or Selected File Types

The following screen presents two drive recovery options:

"Automatic drive recovery. (Recommended)"

During an automatic drive recovery, certain pre-selected file types are used to assist in locating the missing file system. Recover My Files searches for these file types by locating the header / structure and footer and then uses the information found to help pinpoint the missing file system. These files are called "Lost Files"

In Automatic mode, the pre-selected Lost Files types are Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip files (during an "Automated drive recovery", click on OPTIONS > FILE TYPES to view the pre-selected file type).

Learn more about Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

"Drive recovery using selected file types"

This option allows the user to manually select the file types to assist in locating the missing Filesystem.

It is suggested that you only use this option to change the pre-selected file types if you do not have any of the pre-selected file types on the problem disk. For example, if the problem drive had only HTML files on it, it would be necessary to select the HTML file type.

In most cases the common pre-selected file types will be adequate and additional file type selections will NOT be required to locate the entire file and folder structure containing all files.

You may consider adding it to the list if you have a specific file type that is essential to recover. The benefit of adding a file types is that in addition to helping locate the file system, you are simultaneously searching for the Lost File type by looking for its header, structure and footer. If the file system has been destroyed and cannot be recovered, you may still find the important file as a Lost File. However, be aware that adding file types will slow down the search. We suggest that you do not select more than 10 file types at any time.

I am running a Drive Recovery and the file type I wish to add is not in the list.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

Steps within a Partition Recovery

  • Searching for partitions - a fast search to locate missing partitions on the drive;

  • Reading Record - if partitions are located the information contained in the partitions is read;

  • Building directory structure - the file and folder structure of the partition is analyzed;

  • The layout of the file and folder structure is mapped to the disk;

  • The file and folder structure is displayed in the Recover My Files results screen.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Phase 1 of this search is likely only to locate the new installation of Windows (as it is the only existing file system on the current drive). In this situation, it is most likely that you will need to proceed through Phase 2 of the search to recovery the underlying user data.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.


Drive Recovery - System Restore

___________________________________________________

Drive Recovery

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

+ Before you Begin - Read Quick Start Tips here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

+ When to use the 'Recover Drive' option

The "Recover Drive" options is best used when:

  • a drive has been formatted;

  • a drive has been formatted and windows has been reinstalled;

  • a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;

  • a drive letter has gone missing;

  • the drive is recognized by your PC as RAW and not files can be read;

  • or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

A Windows System Recovery/Repair/Restore lost my files

User who have attempted to solve a computer problem using;

  • a Windows recovery CD to repair / restore;

  • the Windows recovery console;

  • using a Windows restore point,

may find that the Recovery/Repair/Restore process has removed access to user created files on the disk.

This situation can be complex. We recommend first following these Drive Recovery instructions below. If files are not found, next run a "Recover Files" in manual mode searching for the specific lost file types.

How to recover files from a Windows Recovery/Repair/Restore

Run Recover My Files and select "Recover a Drive" and click "Next".

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

If your hard disk contained 3 separate partitions, e.g. Drives E:, F:, G:, and your formatted only your G: drive, then it would be best to select and search the G: drive only

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

Drive selection problems:

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ Drive Selection: The drive I wish to search is not listed.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Recover Options, Automatic or Selected File Types

The following screen presents two drive recovery options:

"Automatic drive recovery. (Recommended)"

During an automatic drive recovery, certain pre-selected file types are used to assist in locating the missing file system. Recover My Files searches for these file types by locating the header / structure and footer and then uses the information found to help pinpoint the missing file system. These files are called "Lost Files"

In Automatic mode, the pre-selected Lost Files types are Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip files (during an "Automated drive recovery", click on OPTIONS > FILE TYPES to view the pre-selected file type).

Learn more about Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

"Drive recovery using selected file types"

This option allows the user to manually select the file types to assist in locating the missing Filesystem.

It is suggested that you only use this option to change the pre-selected file types if you do not have any of the pre-selected file types on the problem disk. For example, if the problem drive had only HTML files on it, it would be necessary to select the HTML file type.

In most cases the common pre-selected file types will be adequate and additional file type selections will NOT be required to locate the entire file and folder structure containing all files.

You may consider adding it to the list if you have a specific file type that is essential to recover. The benefit of adding a file types is that in addition to helping locate the file system, you are simultaneously searching for the Lost File type by looking for its header, structure and footer. If the file system has been destroyed and cannot be recovered, you may still find the important file as a Lost File. However, be aware that adding file types will slow down the search. We suggest that you do not select more than 10 file types at any time.

I am running a Drive Recovery and the file type I wish to add is not in the list.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

Steps within a Partition Recovery

  • Searching for partitions - a fast search to locate missing partitions on the drive;

  • Reading Record - if partitions are located the information contained in the partitions is read;

  • Building directory structure - the file and folder structure of the partition is analyzed;

  • The layout of the file and folder structure is mapped to the disk;

  • The file and folder structure is displayed in the Recover My Files results screen.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Phase 1 of this search is likely only to locate the new installation of Windows (as it is the only existing file system on the current drive). In this situation, it is most likely that you will need to proceed through Phase 2 of the search to recovery the underlying user data.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.

Recovery in this situation can be complex. If files are not found in the Drive Recovery search, next run a "Files Recovery" in manual mode searching for the specific lost file types.

--------------------------------------------------------------------------------

© Copyright GetData 2009

Data Recovery Software | www.recovermyfiles.com


Drive Recovery - RAW Hard Disk

___________________________________________________

Recover Drive

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

+ Before you Begin - Read Quick Start Tips here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

+ When to use the 'Recover Drive' option

The "Recover Drive" options is best used when:

  • a drive has been formatted;

  • a drive has been formatted and windows has been reinstalled;

  • a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;

  • a drive letter has gone missing;

  • the drive is recognized by your PC as RAW and not files can be read;

  • or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

What is a RAW hard disk

A RAW or Unallocated hard drive is one which does not contain a recognized partition and therefore will not show up as a drive letter on your computer. This is usually because your existing partition has become corrupt and is no longer recognized by the operating system. Common causes are malicious virus infection, or a system crash.

The term RAW means "not having undergone processes of preparing, dressing, finishing, refining, or manufacture", which describes how hard disk were once sent from the factory, without a partition. RAW and Unallocated are the terms used in Windows Disk Management (right click on My Computer > Manage > Disk Management) to describe the state of the drive:

RAW and Unallocated hard drives are relatively simple to recover as it is usually only the partition information that has become corrupt and the remaining data is intact. Recovery of full file and folder structure is possible.

How to Recover a RAW, Unallocated or missing disk

Run Recover My Files and select "Recover a Drive" and click "Next".

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

If your hard disk contained 3 separate partitions, e.g. Drives E:, F:, G:, and your formatted only your G: drive, then it would be best to select and search the G: drive only

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

Drive selection problems:

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ Drive Selection: The drive I wish to search is not listed.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

I am running a Drive Recovery and the file type I wish to add is not in the list.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

Steps within a Partition Recovery

  • Searching for partitions - a fast search to locate missing partitions on the drive;

  • Reading Record - if partitions are located the information contained in the partitions is read;

  • Building directory structure - the file and folder structure of the partition is analyzed;

  • The layout of the file and folder structure is mapped to the disk;

  • The file and folder structure is displayed in the Recover My Files results screen.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.


Corrupt or Missing Drive

___________________________________________________

Recover Drive

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

+ Before you Begin - Read Quick Start Tips here

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

+ When to use the 'Drive Recovery' option

The "Recover a Drive" options is best used when:

  • a drive has been formatted;

  • a drive has been formatted and windows has been reinstalled;

  • a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;

  • a drive letter has gone missing;

  • the drive is recognized by your PC as RAW and not files can be read;

  • or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

What is a Corrupt Drive?

A corrupt drive generally means that there is an error with your Filesystem.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

This can mean that some of the files and folders on your drive display correctly, whilst others appear corrupt or missing altogether. You may also experience Windows CHKDSK attempting to fix your corrupt drive (and possibly making things worse).

A corrupt drive can be a more complex situation to recover from, as it may only partially effect your files. If you do not known the reason for the corruption, make sure you backup any remaining data of value onto another storage media, as the stability of the problem drive cannot be assured.

How to Recover a Corrupt Drive

Attempting to recover files from a corrupt drive needs a well rounded approach. Successfully recovering missing data can usually be achieved by a combined search strategy. We suggest:

  1. Follow the instructions to recover a Formatted Drive; if you do not find your files;

  2. Follow the instructions to recover Deleted and Lost Files.

  3. if the above two options do not work, it can be useful to ignore the existing file system and perform a sequential scan over the entire drive for specific file types To do this:

click Options > Advanced > select 'Start with a Lost File scan' and 'Scan for lost files across the whole device (and not only in the free space)'.


Drive Recovery - Results Screen

UNDER CONSTRUCTION - Recover My Files Data Recovery Software | English V4.xx
___________________________________________________

Recover Drive

Search Results Screen

A Drive Recovery is targeted at the recovery of partitions from a formatted, corrupt, raw or unallocated hard drive. A successful recovery should locate and display the full file and folder structure in the search results screen.

Recover Drive Folder View

In a "Recover Drive", it usually the "Folder" view which has most relevance, as it displays the file and folder structure of the recovered files (shown as area 4 in this screen-shot). Drive recovery results fall into three categories:

Drive Recover Search Results Screen

Recovered Partitions

When a valid existing partition is located on a drive it is represented in Folder view as follows:

The description of this partition is:

  • "@ 32256" represents the sector on the drive where the partition was located

  • "[NAME]" (if present) represents the volume name of the partition

  • "(2)" represents the number of sub folders that it contains.

Click on the + sign to expand the partition to view the sub folders that it contains. Click on individual files to display the properties for the selected file and a preview of the file.

Recovered Virtual Partitions

A virtual partition is essentially the old underlying partition on a drive. For example, when a hard disk is formatted and Windows is reinstalled, the existing new installation of Windows will be recovered as the active partition (described above) with the old underlying partition recovered as the virtual partition. A virtual partition is represented in Folder view as follows:

  • Virtual Partition(FAT) - represents the type of partition located

  • "@ 19513856" represents the sector on the drive where the partition was located

  • "[NAME]" - (if a name exists) represents the volume name of the partition

  • "(180)" represents the number of sub folders that it contains.

Click on the + sign to expand the partition to view the sub folders that it contains.

Sometimes incomplete or 'ghost' partitions can be located. Each partition shown in "Folder" view should be checked to see if it contains valid data. The primary test is whether individual files contained in the recovered partition is whether individual files can be displayed in the preview window.

Lost File Results

In Drive Recover mode, 'Lost Files' are the file types that were selected (either pre-selected in automatic mode, or manually selected) to aid in the identification of the file system. They are represented in Folder view as:

  • "(92)" represents the number of files that it contains.

Click on the + sign to expand the partition to view the files that it contains.

If the recovery of partitions was NOT successful (or only partially successful), Lost Files can be important as they will still give access to your lost data (but without original file names or folder structure). Learn more about Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

If partition recovery was not successful, it is suggest that you run a second drive recovery, using selected file types, to find your important files.

General Information about the Search Results Screen

The Recover My Files search results screen is broken down into 8 areas, as shown in this screen-shot.

Drive Recover Search Results Screen

1. Text Menu

The text menu is where basic functions are performed, including:

  • Saving or printing a list of search results

  • Saving search results

  • Activating the software

  • Displaying the software version information

    What version number do I have installed?

    To find this information, at the top of the main program screen in text menu items "File | Recover | Help", click on "Help > About". This will open the program About Box which contains the information.

2. Toolbar buttons

The text menu is where basic functions are performed, including:

  • "Start Recovery" starts the search process

  • "Save Files" is used to save the search results

  • "Options" enables the setting of program options

  • "Update" checks for available updates (internet access required)

  • "Help" opens this help file.

3. Search Progress

The search progress area (shown in the screen-shot as area 3) contains important information about the search.

Drive Recover Search Results Screen

Files Found

In a File recovery, the 'Files Found' number represents each Deleted File and each Lost File found.

What is a Lost File?

A Lost File is one that has been deleted, but which no longer has a Windows Operating System record in the FAT or MFT. Windows no longer knows about this file, but content of the file remains on the disk and can be recovered.

Lost files are located using a technique referred to as "data carving".

Data carving is the technique of recovering files based on content. Recover My Files examines the header, content and footer of a file to determine if it matches a known structure, e.g. JPEG, TIF, XLS, DOC etc.

The limitation of data carving is that;

  1. the original file name is not recovered as this information is stored only in the FAT or MFT and is not stored with the file data;

  2. to identify a Lost File, the file format must be understood and included in the list of Recover My Files available file types.

What is a "Deleted File"

On a computer storage device, the term 'Filesystem' is used to describe the schema by which electronic files are stored. A common characteristic of a Filesystem is that they use a table on the drive to track every file on the disk, including user deleted files. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The first version of this table in Microsoft was called the "File Allocation Table" (FAT), but more recently released a new table format called the XFAT, and for NTFS formatted drives, the "Master File Table" (MFT). When a file on the drive is deleted, the FAT or MFT record is marked as such and can be used to find the location of the deleted file and recover it, including the original file name and folder location.

In Drive recover mode, the 'Files Found' number represents each Lost File found and each file found in a recovered partition.

What is a Lost File?

A Lost File is one that has been deleted, but which no longer has a Windows Operating System record in the FAT or MFT. Windows no longer knows about this file, but content of the file remains on the disk and can be recovered.

Lost files are located using a technique referred to as "data carving".

Data carving is the technique of recovering files based on content. Recover My Files examines the header, content and footer of a file to determine if it matches a known structure, e.g. JPEG, TIF, XLS, DOC etc.

The limitation of data carving is that;

  1. the original file name is not recovered as this information is stored only in the FAT or MFT and is not stored with the file data;

  2. to identify a Lost File, the file format must be understood and included in the list of Recover My Files available file types.

Filesystem records

Filesystem records indicate where a missing Filesystem has been found. Each Filesystem record represents a file with its full file and folder name.

The Filesystem records number can be used as a guide to identify when a Drive Recovery can be stopped (without the need to let the search run to the end). Learn more about Filesystem records here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

On a computer storage device, the term 'File System' is used to describe the schema by which electronic files are stored. The most common File Systems are;

  • Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

  • Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

  • Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

  • Apple Macintosh HPFS (High Performance File System); and

  • Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.

4. View Search Results

Recover My Files makes search results available under four different views, access by clicking on the following tabs (as shown in area 2 of this screen-shot):

Drive Recover Search Results Screen

Folder view

The "Folder Tab" is used to display the file and folder structure of the search results and is similar to how Windows displays the files and folders in Windows Explorer. Learn more about the Folder tab here.

"Folder" Tab

The "Folder Tab" is used to display the file and folder structure of the search results and is similar to how Windows displays the files and folders in Windows Explorer.

In File Recover mode, it displays the file and folder structure of Deleted Files.

In Disk Recover mode, it displays the files and folder structure of recovered partitions.

When files are selected and save from Folder view, the folder structure of the saved files will replicate what is displayed here.

File Type view

File Type view lists files according to their extension. This can be used as a fast way to locate a file when the type is know but the original folder location is not. The "Other Extensions" folder contains all other file extensions not specifically selected in the search.

Date view

The "Date" view sorts files by date. Learn more about the Date tab here

Date Tab

The Date tab sorts search results file date. This can be useful to quickly locate digital camera pictures and other files that were known to be created at a specific point in time.

The date used in the sort is changed by selecting one of the following tabs at the bottom of the window:

  • Create date - the date that the file was created;

  • Modified date - the date the file contents was last changed;

  • Accessed date - the date that the files was last accessed (by either a user or a program).

Find

The Find tab is used to search through the existing search results for relevant files based on your selected search criteria. Learn more about the Find tab Learn more about the Find Tab here.

"Find" Tab

The Find tab is used to search through the existing search results for relevant files.

A find can only be run once a search is completed.

5. Preview (and Event Log)

The file preview are is in three windows: 5a, select the individual file; 5b, view the file properties; and 5c, preview the file (see screen-shot). The preview windows may display the following messages:

Drive Recover Search Results Screen

"A preview is not available for this file type": Recover My Files has examined the file header and determined that the file types does not support a preview;

"Corrupt file, preview not available": Recover My Files has examined the file header and determined that it is a file type that can be previewed, however the data inside the file is damaged and a preview of the file cannot be displayed. It is unlikely that when a file that displays this message is saved that it will open properly.

6. Information Bar

Type of search

The bottom left hand corner of the search results screen identifies if "Files Recovery" or "Drive Recovery" mode was selected.

Type of logging

Displays the logging mode that is currently being used. Logging is displayed in the Event Log tab in section 5a (as shown in this screen-shot).

Drive Recover Search Results Screen

Normal Logging: Normal logging provides information about the recovery process.

Debug Logging: Debug logging gives additional information about the recovery process. Debug logging is resource intensive and will slow down a search. It is recommended that you only use debug logging mode when instructed to do so by GetData support staff. Right click on the log screen to copy the information to the windows clipboard.

Selected items to be saved

This shows the number of files selected to be saved and the total size of the files selected, e.g. "Selected items 25 (22.3mb)". In this example, a minimum of 23 megabytes is required on an external drive to save the files. Learn about saving files here.

Search duration

The duration of the search is displayed in the bottom right hand corner of the main program screen.

Troubleshooting

+ Search Progress: The search is very slow - how do I speed it up?

Search speed

In most data recovery situations, you should be able to recover your files within a maximum of 3-4 hours.

There are many factors which can influence the speed of the Recover My Files search. This will include things which you cannot control, such as the size of the hard drive being searched (a 1 terabit drive will take longer than a 250 gigabyte) and the processing speed of your computer. However, however there are also a number of techniques that can be used to obtain maximum recovery in the shortest period of time.

To maintain search speed in "Recover Files" mode:

"Search for deleted files. (Recommended)"

This is recommended option because it is a fast search (less than 1 hour) and may locate your deleted files quickly;

"Search for deleted files, then search for selected Lost File types"

The primary reason that this search will run slow is because more than ten Lost File types have been selected. Select only the important file types first - do NOT select everything.

Whilst the Lost Files search is in progress, monitor the search results screen by clicking between the Folder and File view tabs. If the required files are found and previewed, it is possible to stop the search, save the important files and then resume the search from the same location.

To do this:

  1. Before you stop the search, write down the block number that the search is up to;

  2. Press the stop button;

  3. Click on the OPTIONS button and in the ADVANCED tab place a tick in the box for "prompt for start sector" and "start with Lost File scan";

  4. Click on OK to save these options, then "Start Recovery" > "Drive Recovery" and enter the starting block number.

To maintain search speed in "Recover Drive" mode:

"Automatic Drive Recovery. (Recommended)"

The automatic drive recover is pre-configured to find your files in the shortest period of time.

"Drive Recovery using selected file types"

Only use the selected file type method when your problem drive did not have any of the following file types on it: Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip. When adding additional file types, only add those types essential to the recovery.

In either of these searches, it is not usually necessary to let the search run to the end of the drive:

  • Monitor Folder and File Type views in the search results screen to see if your files have been located;

  • Monitor the number of Filesystem records found is displayed in the progress bar

When the number of "Filesystem Records" found reaches a high number, stops increasing, and remains constant, it means the Filesystem records located have been read (on your average home PC you should reach this point within 2 hours of searching). The average home PC has between 50,000 and 150,000 Filesystem records. Each one represents a file with its full file and folder name.

When you get this point, click the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time) and examine the "Virtual Partition" in Folder view of the results screen.

+ Search Results: Lost Files are all the same size (e.g. 1024kb)

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".
+ Search Results: The recovered file does not contain valid data

Does the saved file contain data?

How do I tell?

Open the file and view the raw data inside the file. You can do this by:

  • using a hex editor;

  • using a file viewing tool such as Explorer View for Windows Explorer, www.explorerview.com and examine the file in HEX mode;

  • renaming the extension of the file to .txt and opening the file with Windows Notepad.

No, the file does not contain any data

In some instances a storage device may have powered down (or gone flat) during the save process. This may cause Recover My Files to save blank files, as the data can no longer be read.

If the saved file is blank, you need to change your drive power settings in the control panel:

Control Panel > Power Options > and make sure that the hard drives are not set to power down after a specific period of time (in XP the setting should be "Never").

After you run the search and before you save the files, check that the drive is running by:

    1. Clicking on a JPEG or DOC file in the Recover My Files search results screen - these file types should preview in the bottom windows of the search results screen;

    2. Open Windows Explorer and click on the drive letter of the problem drive (if you have one). Windows will then probe the drive and you should hear the drive spinning up or the drive light flash.

    3. Once the drive is awake, save the files again with Recover My Files and they will save properly. I suggest you first save a small number of files and then open them to test that they have saved correctly.

Yes, the file does contain data but it will not open

If the save file contains data, but does not open, it is corrupt. Try an alternate method to open the file. E.g.

Explorer View:

Explorer View for Windows Explorer is a file viewing program that can view over 300 file types. In many situations it can read corrupt files that will onto open in their creating application.

Photos:

Irfanview (www.irfanview.com) is a free graphics viewer which is good at opening corrupt image files;

Word Files:

Word Repair is a free Microsoft Word repair utility that can extract text from damaged .doc files

PST Files:

Recover My Email (www.recover-my-email.com) is a tool for reading corrupt Microsoft Outlook .PST files

What causes corrupt files?

Files with their original file name

When a file has been found with its original file name, it has been found by locating a File System record for that file which points to the location of the file data on the disk. In a successful recovery, it should be possible to click on the file found in the results window and preview its content, or save the file and open it normally. If the recovered file does not contain valid data, the possible reasons are:

  1. The file system record is pointing to the correct location on the disk, but that section of the disk has been over-written with new data and no longer contains the correct data for this file. In this case, nothing can be done as the original file has been overwritten and destroyed; or

  2. The file system record is corrupt and no longer points to the correct location on the disk. In this case, the additional search for the Lost Files types will attempt to locate the file by its file structure. If the "Search for deleted files, then search for "Lost File" types" option does not locate the file, run a "Lost File" search over the entire drive, by clicking Options > Advanced > and select Start with a Lost File scan and Scan for lost files across the whole device (and not only in the free space). Ensure that you examine all search results start with the name "Lostfile...".

LostFiles

Lost files are located by searching for the header, structure and footer of the file data. Recover My Files performs a series of tests on each Lost File type, to determine the possibility of recovery. Partially corrupt files will be returned as there is the possibility that the files can be accessed using the methods described above.
See the full troubleshooting guide here


RAID 1 Recovery

RAID 1 is a mirrored set with parity. Typically, it consists of two physical drives, one being an exact copy of the other. The RAID Array continues to operate so long as at least one drive is functioning. Using RAID 1 with a separate controller for each disk is sometimes called duplexing.

Data recovery can be performed on either drive. Follow the instructions for a Drive Recovery.


RAID - JBOD recovery

___________________________________________________

JBOD RAID Recovery

JBOD (Just a Bunch Of Disks) is a term to describe the grouping of odd-sized drives into one larger useful drive. Fore example, a JBOD could combine 3 GB, 15 GB, 5.5 GB, and 12 GB drives into a logical drive at 35.5 GB, which is often more useful than the individual drives separately.

If the JBOD drive is running normally it can be seen and search with Recover My Files like any other drive. If the JBOD drive has an error or is no longer seen as a drive, the proceed with the RAID recovery.

To Recover the RAID:

  1. Ensure the problem RAID drives are properly connected to your computer. Ensure that you can hear the drives spinning and that there are no signs (or sounds) of a physically failed drive;

  2. Run Recover My Files v4, select the "Recover Drive" path and click Next;

  3. In the Drive Selection window, click on the [image] button. This opens the RAID configuration window. Click here for a summary of functions in this window.;

    Adds a drive to the list.

    Adds an image (DD, RAW, EnCase etc.) to the list of drives.

    Replaces a physically missing drive with a blank virtual drive.

    Removes a drive or image from the list.

    Software RAID only: Tests to see if the current disk order is valid.

    Software RAID only: Edit the settings of a software RAID.

    Hardware RAID only: Attempts to determine the order and type of RAID.

    Hardware RAID only: Tests the order of a hardware RAID.

    Used to change the disk order of RAID drives.

  4. In the Add Raid window, select the type of RAID you are trying to recover and click the [image] button to add the RAID drives (Note: if you have taken image copies of the drive [DD, RAW, EnCase etc] use the "Add Image..." button);

Is the RAID a Hardware RAID or Software RAID?

  • I do not know

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a software RAID (where computer software alone is responsible for managing the RAID disks).

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a hardware RAID (where a physical device, e.g. a RAID card plugged into my computer) is responsible for managing the RAID disks.

    If you know the parameters of your hardware RAID drive:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files) in the correct sequence;

    3. Enter the Stripe Size and Offset Sectors;

    4. Click OK to add the RAID drive and then proceed with the search.

    If you do NOT know the parameters of your hardware RAID drive:

    Recover My Files will attempt to identify the way in which the RAID was configured. To do this:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files)in the correct sequence, or, if the correct sequence is unknown, add them in the order that is believe to be most correct;

    3. Click on the "Find Layout" button to find a suggested configuration. A suggested configuration is indicated by a green tick next to each added drive.

    Important:

    A suggested configuration is based on the information available from the drives. However, due to the complexity of a RAID structure, there may be more than one configuration that returns this results. A suggested configuration should be tested by continuing with the recovery to successfully locate missing files.

    File Layout did not return a suggested configuration, or,
    The suggested configuration did not result in a successful recovery

    If the Find Layout button did not return green ticks for each added drive, or the continued recovery from a suggested configuration did not work, try the following:

    1. click on the "Probable Solutions" tab to view suggested configurations for the RAID;

    2. change the "stipe size", RAID Options and drive sequence as suggested;

    3. click the "Test Layout" button to test the modified configuration;

    4. re-try the recovery.

Once added, select and search the RAID drive

Once the RAID has been added to the list of available drives, select the RAID as the drive to search and click Next:

The RAID drive can now be search like any other drive on your system. In most cases, because of the initial problem with the RAID, it will be best to run the Recover Drive mode. However, it is also possible to search the drive in Recover Files mode.


RAID 0 (striping) recovery

___________________________________________________

RAID 0 Recovery

A RAID 0 (also known as a stripe set or striped volume) splits data evenly across two or more disks (striped) with no parity information for redundancy. It is important to note that RAID 0 was not one of the original RAID levels and provides no data redundancy. RAID 0 is normally used to increase performance, although it can also be used as a way to create a small number of large virtual disks out of a large number of small physical ones.

A RAID 0 can be created with disks of differing sizes, but the storage space added to the array by each disk is limited to the size of the smallest disk. For example, if a 120 GB disk is striped together with a 100 GB disk, the size of the array will be 200 GB.

To Recover the RAID:

  1. Ensure the problem RAID drives are properly connected to your computer. Ensure that you can hear the drives spinning and that there are no signs (or sounds) of a physically failed drive;

  2. Run Recover My Files v4, select the "Recover Drive" path and click Next;

  3. In the Drive Selection window, click on the [image] button. This opens the RAID configuration window. Click here for a summary of functions in this window.;

    Adds a drive to the list.

    Adds an image (DD, RAW, EnCase etc.) to the list of drives.

    Replaces a physically missing drive with a blank virtual drive.

    Removes a drive or image from the list.

    Software RAID only: Tests to see if the current disk order is valid.

    Software RAID only: Edit the settings of a software RAID.

    Hardware RAID only: Attempts to determine the order and type of RAID.

    Hardware RAID only: Tests the order of a hardware RAID.

    Used to change the disk order of RAID drives.

  4. In the Add Raid window, select the type of RAID you are trying to recover and click the [image] button to add the RAID drives (Note: if you have taken image copies of the drive [DD, RAW, EnCase etc] use the "Add Image..." button);

Is the RAID a Hardware RAID or Software RAID?

  • I do not know

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a software RAID (where computer software alone is responsible for managing the RAID disks).

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a hardware RAID (where a physical device, e.g. a RAID card plugged into my computer) is responsible for managing the RAID disks.

    If you know the parameters of your hardware RAID drive:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files) in the correct sequence;

    3. Enter the Stripe Size and Offset Sectors;

    4. Click OK to add the RAID drive and then proceed with the search.

    If you do NOT know the parameters of your hardware RAID drive:

    Recover My Files will attempt to identify the way in which the RAID was configured. To do this:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files)in the correct sequence, or, if the correct sequence is unknown, add them in the order that is believe to be most correct;

    3. Click on the "Find Layout" button to find a suggested configuration. A suggested configuration is indicated by a green tick next to each added drive.

    Important:

    A suggested configuration is based on the information available from the drives. However, due to the complexity of a RAID structure, there may be more than one configuration that returns this results. A suggested configuration should be tested by continuing with the recovery to successfully locate missing files.

    File Layout did not return a suggested configuration, or,
    The suggested configuration did not result in a successful recovery

    If the Find Layout button did not return green ticks for each added drive, or the continued recovery from a suggested configuration did not work, try the following:

    1. click on the "Probable Solutions" tab to view suggested configurations for the RAID;

    2. change the "stipe size", RAID Options and drive sequence as suggested;

    3. click the "Test Layout" button to test the modified configuration;

    4. re-try the recovery.

Once added, select and search the RAID drive

Once the RAID has been added to the list of available drives, select the RAID as the drive to search and click Next:

The RAID drive can now be search like any other drive on your system. In most cases, because of the initial problem with the RAID, it will be best to run the Recover Drive mode. However, it is also possible to search the drive in Recover Files mode.


RAID 5 (striping with redundancy) recovery

___________________________________________________

RAID 5 Recovery

A RAID 5 uses block - level striping with parity data distributed across all member disks. Distributed parity means that if a single drive fails the array is not destroyed. Upon a drive failure, any subsequent drive reads can be calculated from the distributed parity of the functioning drives. A single drive failure in the set will result in reduced performance of the entire set until the failed drive has been replaced and rebuilt.

To Recover the RAID:

  1. Ensure the problem RAID drives are properly connected to your computer. Ensure that you can hear the drives spinning and that there are no signs (or sounds) of a physically failed drive;

  2. Run Recover My Files v4, select the "Recover Drive" path and click Next;

  3. In the Drive Selection window, click on the [image] button. This opens the RAID configuration window. Click here for a summary of functions in this window.;

    Adds a drive to the list.

    Adds an image (DD, RAW, EnCase etc.) to the list of drives.

    Replaces a physically missing drive with a blank virtual drive.

    Removes a drive or image from the list.

    Software RAID only: Tests to see if the current disk order is valid.

    Software RAID only: Edit the settings of a software RAID.

    Hardware RAID only: Attempts to determine the order and type of RAID.

    Hardware RAID only: Tests the order of a hardware RAID.

    Used to change the disk order of RAID drives.

  4. In the Add Raid window, select the type of RAID you are trying to recover and click the [image] button to add the RAID drives (Note: if you have taken image copies of the drive [DD, RAW, EnCase etc] use the "Add Image..." button);

Is the RAID a Hardware RAID or Software RAID?

  • I do not know

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a software RAID (where computer software alone is responsible for managing the RAID disks).

    Set the "Type" of RAID to "software".

    Press the [image] to test to see if it is a valid software RAID.

    A valid software RAID will show with green ticks on the added drives (or image files):

    If it is not a valid software RAID, you will receive the message below. In this case follow the hardware RAID instructions:

  • I have a hardware RAID (where a physical device, e.g. a RAID card plugged into my computer) is responsible for managing the RAID disks.

    If you know the parameters of your hardware RAID drive:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files) in the correct sequence;

    3. Enter the Stripe Size and Offset Sectors;

    4. Click OK to add the RAID drive and then proceed with the search.

    If you do NOT know the parameters of your hardware RAID drive:

    Recover My Files will attempt to identify the way in which the RAID was configured. To do this:

    1. Set the RAID type to "hardware";

    2. Add the drives (or image files)in the correct sequence, or, if the correct sequence is unknown, add them in the order that is believe to be most correct;

    3. Click on the "Find Layout" button to find a suggested configuration. A suggested configuration is indicated by a green tick next to each added drive.

    Important:

    A suggested configuration is based on the information available from the drives. However, due to the complexity of a RAID structure, there may be more than one configuration that returns this results. A suggested configuration should be tested by continuing with the recovery to successfully locate missing files.

    File Layout did not return a suggested configuration, or,
    The suggested configuration did not result in a successful recovery

    If the Find Layout button did not return green ticks for each added drive, or the continued recovery from a suggested configuration did not work, try the following:

    1. click on the "Probable Solutions" tab to view suggested configurations for the RAID;

    2. change the "stipe size", RAID Options and drive sequence as suggested;

    3. click the "Test Layout" button to test the modified configuration;

    4. re-try the recovery.

Once added, select and search the RAID drive

Once the RAID has been added to the list of available drives, select the RAID as the drive to search and click Next:

The RAID drive can now be search like any other drive on your system. In most cases, because of the initial problem with the RAID, it will be best to run the Recover Drive mode. However, it is also possible to search the drive in Recover Files mode.


iPod Recovery

Loss of music files from an iPod is a common occurrence. In most situations, the music files can be recovered from the iPod and saved back to a PC. Select your situation below:

+ I Pressed the iTunes Restore Button / My iPod was Restored to Factory Settings

The Restore button appears in iTunes when the iPod is connected to your PC. It restores the iPod to its original factory condition. All existing song on the iPod are lost, but can be recovered.

If you still have your iTunes library, your songs, videos, pod casts, audio books, and games can be synced back to your iPod. If not, you need Recover My Files to recover the files from the iPod disk.

Before you Begin

 Important

Do Not Connect your iPod to iTunes. If iTunes starts running, immediately shut it down.

Why? The default setting in iTunes when an iPod is connected is to "auto-sync". This means that iTunes will try and write it's list of songs to your iPod.

It is important when performing iPod data recovery not to write new data to iPod drive unless it is necessary to do so. Do not connect to iTunes unless we specifically give instructions to do so.

Steps to iPod Recovery

1. Place your iPod in Disk Mode

Place your iPod in Disk Mode

Place your iPod in Disk Mode

Disconnect your iPod from your PC and place it into "Disk Mode". This enables your computer to see the iPod as a standard hard drive:

  1. Toggle the Hold switch on and off. (Set it to Hold, then turn it off again.)

  2. Press and hold the Menu and Select buttons for at least 6 seconds until the Apple logo appears.

  3. When the Apple logo appears, release the Menu and Select buttons and immediately press and hold the Select and the Play/Pause buttons until the Disk Mode screen appears.

For more information about putting your iPod into disk mode, visit Apple at: http://support.apple.com/kb/HT1363

Note: The iPod Touch or iPhone do not have a disk mode.

If you cannot force your iPod into disk mode, your iPod may have a hardware issue. You may need to see a local Apple hardware service center.

2. Run a "Recover Drive" search

Start Recover My Files and select "Recover Drive". Click Next.

In the drive selection window, highlight the iPod hard disk with your mouse (as shown below). Click Next.

In the search selection window, select "Automatic drive recovery. (Recommended)". Click Start.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partition. If the partition can be recovered, all of the missing folders and files structure will be displayed.

Part 1 of the search should take between 1 - 30 minutes to complete (depending on the size of the drive and the number of files that it contains).

It is possible to stop the search during phase 1 (by pressing the "Stop" button, however it is necessary to complete this phase for the file and folder structure to build and display .

Search Phase 2 - Recovering Lost Files

Phase 2 of the search has two functions;

  • it searches for fragments of file system records (MFT and FAT) that can be used to rebuild full file and folder structure;

  • sequentially scan the remaining blocks of the hard disk to locate " Lost Files".

    What is a Lost File?

    A Lost File is one that has been deleted, but which no longer has a Windows Operating System record in the FAT or MFT. Windows no longer knows about this file, but content of the file remains on the disk and can be recovered.

    Lost files are located using a technique referred to as "data carving".

    Data carving is the technique of recovering files based on content. Recover My Files examines the header, content and footer of a file to determine if it matches a known structure, e.g. JPEG, TIF, XLS, DOC etc.

    The limitation of data carving is that;

    1. the original file name is not recovered as this information is stored only in the FAT or MFT and is not stored with the file data;

    2. to identify a Lost File, the file format must be understood and included in the list of Recover My Files available file types.

It is possible to stop the search for lost files and recommence it at a later time from the same position. Learn more here.

  1. Before you stop the search, write down the block number that the search is up to, e.g. "3,867,514 of 78,126,048";

  2. Press the stop button;

  3. Click the OPTIONS button in the main program screen, go to the ADVANCED tab and place a tick in the box for "prompt for start sector" and "Start with Lost File Scan".

  4. Click OK to save these options, then press "Start Recovery" > "Drive Recovery" and enter the starting location

3. Examine iPod search results

A iPod recovery results screen is shown below:

In

"Folder" Results

At the end of the search, select the "Folder" tab to view the recovered file and folder structure ("1" in the screen shot above). You music files can be located in folders called "iPod Controls > Music > F00, F01, F02 and so forth. Inside these folders are your music files. They are not organized in a any particular fashion within these folders, you can organize them later.

"Lost File" Results

If the file and folder structure was NOT recovered, then look in "Lost File Results" ("2" in the screen shot above).

Saving Your Files

From the Folder tab of the Recover My Files results screen, save the contents of the "Music" folder or the "Lost Files" folder to your hard drive or whatever other device you choose. Learn more about saving files here.

Do not worry that you cannot understand the file name, because the song information (artist, title, album etc.) is hidden into the file. When you play them in Itunes, Winamp, Windows Media Player or QuickTime and then you can see all information such as Album Name and Singer.

Once you have the files saved on your computer, you can re-import them into iTunes using the "File" or "Folder" > Import function in iTunes. You should then see full artist, title, album etc. in your iTunes library.

+ I Synced my iPod with an Empty iTunes Library

Syncing with an empty iTunes library can easily happen if you plug your iPod into a new computer.

With the iPod, the sync process only ever happens one way, PC / iTunes > iPod, so a new blank library is written to you iPod full of songs.

Syncing with a blank iTunes library does not permanently erase the songs on your iPod and they can be recovered.

Before you Begin

Important

Do Not Connect your iPod to iTunes. If iTunes starts running, immediately shut it down.

Why? The default setting in iTunes when an iPod is connected is to "auto-sync". This means that iTunes will try and write it's list of songs to your iPod.

It is important when performing iPod data recovery not to write new data to iPod drive unless it is necessary to do so. Do not connect to iTunes unless we specifically give instructions to do so.

Place your iPod in Disk Mode

Place your iPod in Disk Mode

Disconnect your iPod from your PC and place it into "Disk Mode". This enables your computer to see the iPod as a standard hard drive:

  1. Toggle the Hold switch on and off. (Set it to Hold, then turn it off again.)

  2. Press and hold the Menu and Select buttons for at least 6 seconds until the Apple logo appears.

  3. When the Apple logo appears, release the Menu and Select buttons and immediately press and hold the Select and the Play/Pause buttons until the Disk Mode screen appears.

For more information about putting your iPod into disk mode, visit Apple at: http://support.apple.com/kb/HT1363

Note: The iPod Touch or iPhone do not have a disk mode.

If you cannot force your iPod into disk mode, your iPod may have a hardware issue. You may need to see a local Apple hardware service center.

1. iPod "Recover Drive" search

Start Recover My Files and select "Recover Drive". Click Next.

In the drive selection window, highlight the iPod hard disk with your mouse (as shown below). Click Next.

In the search selection window, select "Automatic drive recovery. (Recommended)". Click Start.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partition. If the partition can be recovered, all of the missing folders and files structure will be displayed.

Part 1 of the search should take between 1 - 30 minutes to complete (depending on the size of the drive and the number of files that it contains).

It is possible to stop the search during phase 1 (by pressing the "Stop" button, however it is necessary to complete this phase for the file and folder structure to build and display.

Search Phase 2 - Recovering Lost Files

Phase 2 of the search has two functions;

  • it searches for fragments of file system records (MFT and FAT) that can be used to rebuild full file and folder structure;

  • sequentially scan the remaining blocks of the hard disk to locate Lost Files.

It is possible to stop the search for lost files and recommence it at a later time from the same position. Learn more here.

You can stop the Phase 2, Lost File search, this search and restart it at the same location by doing the following:

  1. Write down the block number that the search is up to, e.g. 3,867,514 of 78,126,048;

  2. Press the stop button;

  3. Click the OPTIONS button in the main program screen, go to the ADVANCED tab and place a tick in the box for "prompt for start sector" and "Start with Lost File Scan". Click OK to save these options, then press "Start Recovery" > "Drive Recovery" and enter the starting location

2. Examine iPod search results

A iPod recovery results screen is shown below:

In

"Folder" Results

At the end of the search, select the "Folder" tab to view the recovered file and folder structure ("1" in the screen shot above). You music files can be located in folders called "iPod Controls > Music > F00, F01, F02 and so forth. Inside these folders are your music files. They are not organized in a any particular fashion within these folders, you can organize them later.

"Lost File" Results

If the file and folder structure was NOT recovered, then look in "Lost File Results" ("2" in the screen shot above).

Saving Your Files

From the Folder tab of the Recover My Files results screen, save the contents of the "Music" folder or the "Lost Files" folder to your hard drive or whatever other device you choose. Learn more about saving files here.

Do not worry that you cannot understand the file name, because the song information (artist, title, album etc.) is hidden into the file. When you play them in Itunes, Winamp, Windows Media Player or QuickTime and then you can see all information such as Album Name and Singer.

Once you have the files saved on your computer, you can re-import them into iTunes using the "File" or "Folder" > Import function in iTunes. You should then see full artist, title, album etc. in your iTunes library.

+ I Synced another iTunes Library to My iPod

If you plug your iPod into a PC other than your own, it is possible that iTunes on that computer could sync and another persons songs get written to your iPod.

The process of writing new songs to an iPod will overwrite and permanently erase existing files. However, if the volume of new songs is less than the volume of songs that were on your iPod, then there is still the possibility to recover the remainder of your songs.

Before you Begin

Important

Do Not Connect your iPod to iTunes. If iTunes starts running, immediately shut it down.

Why? The default setting in iTunes when an iPod is connected is to "auto-sync". This means that iTunes will try and write it's list of songs to your iPod.

It is important when performing iPod data recovery not to write new data to iPod drive unless it is necessary to do so. Do not connect to iTunes unless we specifically give instructions to do so.

Place your iPod in Disk Mode

Place your iPod in Disk Mode

Disconnect your iPod from your PC and place it into "Disk Mode". This enables your computer to see the iPod as a standard hard drive:

  1. Toggle the Hold switch on and off. (Set it to Hold, then turn it off again.)

  2. Press and hold the Menu and Select buttons for at least 6 seconds until the Apple logo appears.

  3. When the Apple logo appears, release the Menu and Select buttons and immediately press and hold the Select and the Play/Pause buttons until the Disk Mode screen appears.

For more information about putting your iPod into disk mode, visit Apple at: http://support.apple.com/kb/HT1363

Note: The iPod Touch or iPhone do not have a disk mode.

If you cannot force your iPod into disk mode, your iPod may have a hardware issue. You may need to see a local Apple hardware service center.

Run Recover My Files and select the "Recover Files" option:

Select the drive letter of your iPod:

In the search selection window, select Search for deleted files, then search for selected "Lost File" types. In the file type selection screen, ensure that you have the following file types selected:

  • iTunes audio file (.m4a, .m4b, .m4p)

  • MP3 Music file (.mp3, .mp, .mp1, .mp2)

  • and any other file types which were stored on your iPod that you wish to recover.

Click "Start" to commence the search. Recover My Files will scan your iPod and look for "Lost Files". These files will be displayed under the "Folder" tab in the "Lost File Results" folder:

It is possible to stop the search for lost files and recommence it at a later time from the same position. Learn more here.

  1. Before you stop the search, write down the block number that the search is up to, e.g. "3,867,514 of 78,126,048";

  2. Press the stop button;

  3. Click the OPTIONS button in the main program screen, go to the ADVANCED tab and place a tick in the box for "prompt for start sector" and "Start with Lost File Scan".

  4. Click OK to save these options, then press "Start Recovery" > "Drive Recovery" and enter the starting location

Saving Your Files

From the Folder tab of the Recover My Files results screen, save the contents of the "Lost File Results" folder. Do not worry that the file name is not correct, because the song information (artist, title, album etc.) is hidden into the file. When you play them in Itunes, Winamp, Windows Media Player or QuickTime and then you can see all information such as Album Name and Singer.

Once you have the files saved on your computer, you can re-import them into iTunes using the "File" or "Folder" > Import function in iTunes. You should then see full artist, title, album etc. in your iTunes library.

+ My iPod has a Sad Face icon

If your iPod displays a sad iPod icon it is usually NOT a good sign. In most cases, the sad iPod icon indicates a hardware issue.

Test your iPod by manually placing the iPod in "Disk Mode". If you are able to force iPod into Disk Mode then it may not be a hardware issue.

Place your iPod in Disk Mode

Place your iPod in Disk Mode

Disconnect your iPod from your PC and place it into "Disk Mode". This enables your computer to see the iPod as a standard hard drive:

  1. Toggle the Hold switch on and off. (Set it to Hold, then turn it off again.)

  2. Press and hold the Menu and Select buttons for at least 6 seconds until the Apple logo appears.

  3. When the Apple logo appears, release the Menu and Select buttons and immediately press and hold the Select and the Play/Pause buttons until the Disk Mode screen appears.

For more information about putting your iPod into disk mode, visit Apple at: http://support.apple.com/kb/HT1363

Note: The iPod Touch or iPhone do not have a disk mode.

If you cannot force your iPod into disk mode, your iPod may have a hardware issue. You may need to see a local Apple hardware service center.

If you successfully get your iPod into disk mode, follow the instructions in this help file titled: "I Pressed the iTunes Restore Button / My iPod was Restored to Factory Settings".

If you cannot force your iPod into disk mode and the sad face icon persists, then your iPod has a hardware issue. It may still be possible to recover your data, but you will need to send to your iPod to a hardware data recovery service.

+ I want to copy the music off my iPod and put it on my computer

It is possible to copy music from an iPod to a computer by using the iPod's Disk Mode. In Disk Mode, the iPod will show as a drive letter on your PC so that files can be copied from one drive to another.

Before you Begin

Important

Do Not Connect your iPod to iTunes. If iTunes starts running, immediately shut it down.

Why? The default setting in iTunes when an iPod is connected is to "auto-sync". This means that iTunes will try and write it's list of songs to your iPod.

It is important when performing iPod data recovery not to write new data to iPod drive unless it is necessary to do so. Do not connect to iTunes unless we specifically give instructions to do so.

Place your iPod in Disk Mode

Place your iPod in Disk Mode

Disconnect your iPod from your PC and place it into "Disk Mode". This enables your computer to see the iPod as a standard hard drive:

  1. Toggle the Hold switch on and off. (Set it to Hold, then turn it off again.)

  2. Press and hold the Menu and Select buttons for at least 6 seconds until the Apple logo appears.

  3. When the Apple logo appears, release the Menu and Select buttons and immediately press and hold the Select and the Play/Pause buttons until the Disk Mode screen appears.

For more information about putting your iPod into disk mode, visit Apple at: http://support.apple.com/kb/HT1363

Note: The iPod Touch or iPhone do not have a disk mode.

If you cannot force your iPod into disk mode, your iPod may have a hardware issue. You may need to see a local Apple hardware service center.

  1. Once you iPod is in Disk Mode, connect it to your PC.

  2. Click on the drive letter that represents your iPod (it will probably be E: or F:).

  3. Folders on your iPod are usually "hidden". To display these folder, in the Windows Explorer navigation menu, click on "Tools-> Folder Options" and click on the "View" tab. Choose the "Show Hidden Files and Folders" option and click "OK."

  4. Look for the "iPod Control" folder and open it. Click on "Music" in that folder. There should be a number of other folders here, named F00, F01, F02 and so forth. These are your music files. They are not organized in a any particular fashion within these folders, you'll have to organize them later.

  5. Copy the "Music" folder to your hard drive or whatever other device you choose. Or, if you do not want to select all the files, pick and choose through the MP3s. You should be able to see the file names as you mouse over each individual file.

  6. After you have copied all your files from iPod into your Computer you can see that all files are labeled with 4 letter file name. You cannot understand which file is for which Song because all information is hidden into the file. But do not worried about that because you can play them in Winamp, Windows Media Player or QuickTime and then you can see all information such as Album Name, Singer and all other information what you added before in your iTunes. You can then rename the files if you would like or you can keep them as they are.


MAC Recovery

It is possible to recover a Macintosh drive using Recover My Files.

NOTE: Recover My Files will NOT run on a Macintosh. It is necessary to connect the problem MAC drive to a Windows PC and then use Recover My Files installed on the Windows PC to search for and recover files from the MAC drive.

The easiest option is usually to connect the MAC drive to the Windows PC using a USB drive enclosure.

Once the drive is connected, follow the "Recover Drive" instructions.


Save and Load Search Results

Recover My Files Data Recovery Software | English V4.xx
___________________________________________________

Saving

Save and re-load search results

Recover My Files v4 has the ability to save search results so that they can be reloaded and used at a later time. Results are saved into a .rsv file.

Important: A saved-search.rsv file is a record of search results at the point in time when the file was created.

If data is subsequently written to the problem media, it may overwrite and destroy files listed in the saved-search.rsv file and consequently reduce the accuracy by which it can be used at a later time.

When conducting data recovery it is important to minimize the use of the problem media until such time as the data recovery attempts have been completed.

To Save Search Results

  1. In the text menu at the top of the main program screen select "Recover > Save Search..."
  2. Select the location and file name where you would like to save the search results.

To Load Search Results

  1. Ensure the original media used to create the saved-search.rsv file is plugged in and has the same drive letter as it did when the file was created;
  2. Click "Recover > Load Search...";
  3. Select the .rsv file containing your saved search results and click OK;
  4. The Recover My Files search results screen should then display the saved search results;
  5. Once the search has loaded you should see the message "Load Complete".


Save a text listing of search results

___________________________________________________

Saving

Save or print a text listing of search results

In some circumstances it may be necessary to save or print a text listing of search results.

At the top of the main program screen are the menu items "File | Recover | Help". Click "File" to display the save and printing options.

A printed report it sent directly to the printer. A warning message will be displayed if print exceeds 10 pages.


Saving Recovered Files

___________________________________________________

Saving

Saving Recovered Files

This section relates to the saving of your recovered files (for information on how to save search results so that they can be reloaded into Recover My Files at a later time, click here).

Program Activation

In order to save files, you must activate the program with a product activation key.

Note: To save files from a RAID recovery, your need to purchase a "Recover My Files Professional" or "Data Recovery Technician" license. For more information, learn about license types and program activation here.

How do I select Files to be saved?

  • To select a file to be saved; in the search results window place a tick in the box next to the file;

  • To select a folder to be saved; in the search results window place a tick in the box next to the folder to be saved. All files in that folder will automatically be ticked (selected).

  • To select a group of files and folders to be saved: Hold down the SHIFT key (for groups) or CTRL key (for individual selections), use your mouse to select the files that you require and then press the SPACE BAR key to turn the selection tick on or off.

What files should I save?

Recover My Files is designed to get back your created photos, documents, music etc. Select and save the files that are most important to you. Remember;

There is no point saving gigabytes of Windows System files that will be worthless to you and it will just slow the saving process down;

Rather than trying to recover and save software programs, it is better to reinstall software programs from the original disks or installation files to be sure the integrity of their registry settings etc.

How much space will I need to save the files?

In the bottom boarder of the Recover My Files search results window you will see the number of files selected, and the total size of the files selected, e.g. "Selected items 25 (22.3mb)".

During the saving process, as each file is saved, the selection tick is removed from the file and correspondingly the number of "Selected items" and the total size of selected files is reduced.

If the media that you are saving to runs out of space, simply connect new media and restart the save process.

TIP: It is prudent to save files in manageable volumes. For example, instead of trying to save 2 terra byte of data in one go, Windows may find it less intensive if you were to break it up into 4 x 500 segments.

The "Save Files" button

The Save Files button has three options:

"Save Files"

Press the "Save Files" button and the selected files will be automatically saved to your chosen location. The saved files will have exactly the same file and folder structure that appears in the search results screen.

"Save Files As..."

The "Save Files As..." button prompts you to give each file a new name as it is saved. If you have selected many files this can be very time consuming. It is recommended that you only use "Save As" if you are saving a small number of files and wish to change the file names during the save process.

"Save to a CD/DVD"

Recover My Files has the capability to save files directly to a CD or DVD. Importantly, the is a secure process which does not write new data to the disk. Learn more about saving files to a CD or DVD here.

Where do I save files?

Recover My Files is designed specifically so that it does not alter the content of the drive being searched. This avoids new data overwriting and permanently destroying deleted or missing files that could have other wise been recovered. For this reason:

You must save files found with Recover My Files to a drive other than the one from which the files are being recovered.

Your primary options are:

  1. Save to another drive;

    This can be another drive letter on you hard drive (e.g.: Drive "D:\"), another separate hard drive connected inside to your computer or an external hard drive connected by USB, Fire Wire, or other method.

  2. Save to a CD or DVD;

    Search results can be written directly to a CD or DVD. Learn more about saving files to a CD or DVD here.

  3. Save to a Network Drive;

    In order to save files to a network drive, the remote location must be shared as a drive letter on the computer which is running Recover My Files. Then, when the "Browse" button is selected in the Recover My Files "Save Files" window (shown below) it is possible to navigate to and select this remote drive letter.

File Saving Options

Select the "Save Location" by either typing the destination path, e.g. "C:\recovery\" or using the "Browse..." button to select the desired destination.

Current "Save Settings" can be view by selecting the drop down arrow and save settings can be changed by selecting "Set Options" button:

What will the files look like when they are saved?

If you are saving files from "Folder" view of the Recover My Files search results screen, the files that are saved will have same file names and folder structure that you see in this screen.

If you are saving files from "File Type" view, the files that are saved will have same file names and folder structure that you see in the "File Type" view.

What happens after I save the files?

As a file is saved, the tick is removed from the selection box.

The results stay in the search window. In Recover My Files version 4, the results only disappear if you start a new search or close the program. You can only reload the existing search results if you have previously save them - learn how here.

Always go to the drive where the files were saved and open them to test if they have been saved correctly.

Never write new data to the problem drive until you are sure that you have recovered all data that you need. Writing new data to the drive will change its content and may overwrite and destroy deleted or missing files so that a new search will Recover My Files will no longer find them.


Saving files to a CD or DVD

___________________________________________________

Saving

Saving Files to a CD or DVD

Recover My Files has the capability to save files directly to a CD or DVD. Importantly, the is a secure process which does not write new data to the disk.

To save files to a CD or DVD, select the drop down arrow next to the "Save Files" button in the main program tool bar:

The CD burning window will then open:

Burner | Displays a list of supported available CD or DVD burners connected to your computer. If a CD or DVD is not inserted, it will say [No Media Inserted]. If a CD or DVD is inserted, it will identify the type of CD or DVD, e.g. CD-R. Click the "Refresh" button to ensure the information in this window is up to date.
 | The open/eject button opens the selected CD/DVD drive draw.
 | The CD/DVD information button provides information about the currently inserted CD or DVD.
 | The refresh button re-scans the CD/DVD drive to provide new information about the currently inserted CD/DVD.
Disk Name | This is the name that is given to the CD/DVD. The default is "RMF[date]" but can be edited as required.

Click Next and the following window will provide a summary of the data to be burnt to CD or DVD. This includes an estimation as to the number of standard CD (approximately 650 mb capacity) and DVD (approximately 4gb capacity) that will be required:

Click Next to start the burn process. Pay close attention to the burning log for any errors:

When the CD or DVD burning session is completed, a the following screen will display a summary of the burning process:

Important: Once you have saved your data to CD or DVD, always check the contents of the CD or DVD manually to ensure that the data have been properly recorded.

Trouble Shooting - Saving Files to a CD or DVD

Problem: My burner or CD/DVD is not recognized.
Solution:

  • Re-insert the CD and press the "Refresh" button.

  • Press the drop down arrow in the "Burner" field to select the available burners. The burner should display the type of CD or DVD inserted (e.g. CD-R). If not, try a different CD and/or a different type of CD (e.g. CD +R).

    If the burner is not listed, check all burner connections and repeat this process. If the burner is still not listed, it is not compatible with Recover My Files and you will need to select an alternate location to save your files such as a USB drive.

Problem: The burning process fails.
Solution:

Examine the event log for any errors that may indicate the source of the problem.

  • Insert a new blank CD or DVD. Click the "Refresh" button to ensure that the CD or DVD is recognized.

  • Press the information button. The select the "Device / Disk Speed" tab and select the "Calibrate" button. This will determine the optimum settings for your device. Now re-try the burn process.

  • If CD/DVD burning problems continue, repeat the process using a different type/brand of CD/DVD media, or if possible, try saving to an alternate media such as an external USB hard drive.

  • If the problem persists, please contact us via the support link at www.recovermyfiles.com and provide:

a brief but accurate description of the problem;

a screen print of the CD/DVD Burning log.


The Options Button

To access the program options, click on the Options button in the main program tool bar.

File Types Tab

General Tab

The "General" tab contains options such as whether the Recover My Files "Wizard" or "Tips on Startup" dialogue boxes appear when the program is opened.

"Event Logging" can be set to 3 levels; None, Normal and Debug. The Event Log is displayed under a tab in the Preview Window. It contains detailed information about the activity of the program and can assist in troubleshooting the File Recovery process.

If the box "Show Properties box in Preview Panel" is checked the Lower Left-side Preview Pane will be visible.

If the box "Show unknown types in Hex view" is checked then file types that have not been selected or not recognized by Recover My Files will be displayed in raw hexadecimal format. Use this option if you wish to view unrecognized files in raw hexadecimal format.

Search Tab

The "Search" tab controls how Recover My Files will search for your Deleted and Lost Files.

Save Tab

Save to CD / DVD

Import Last Track:

If the CD or DVD has previously been used to store data, the "Import Last Track" setting ensures that this existing data will still be available on the disk after the new data has been burnt by Recover My Files.

Do Not Import Old Data:

The opposite of "Import Last Track", if "Do Not Import Old Data" is selected, any existing data on the CD or DVD will not be visible after the new data is burnt with Recover My Files.

Close CD / DVD

Closing a CD or DVD at the end of a burn means that no further data can be burnt to that disk.

Advanced Tab

Prompt for Start Sector

If you tick this option, Recover My Files will prompt you for the sector location on the disk to start the 'Lost File' search. You can use this option to search a hard disk in sections.

Tip: Before you stop a search, note down the "block" (sector) that the search is up to (as shown near the search progress bar) so that you can use this as the sector number to continue a new search from where you left off.

Use SPTI if Available

SPTI (SCSI Pass-Through Interface) from Microsoft is a method of accessing storage devices in your PC.

Show MD5 Hash

An MD5 hash is a mathematical calculation performed on a file to create a 32-digit number unique to that file. It is most often used to identify a specific file. For example, if the MD5 hash of a file is known, it can be compared to a recovered file to confirm that it is identical.

Turning this feature on, will display the MD5 hash value in the file properties window when you click on a file in the search results screen. Note that because and MD5 hash involves an additional calculation, it requires additional computer resources and will slow down the search.

Run a Lost File search only

Selecting this option will over-ride the Recover My Files Wizard selection and will cause Recover My Files to perform ONLY a 'Lost File' search of the entire drive from the first sector to the last.

Scan for lost files across the whole device (and not only in the free space)

In its normal operation, Recover My Files reads the existing file system/s and any recovered file system/s and treats this as allocated space. Then, when it moves into the scan for Lost Files, it scans only the unallocated space. The goal is to reduce the volume of data that needs to be searched to make the search faster.

Using the option “Scan for lost files across the whole device” tells Recover My Files that when it gets to the Lost File search, it needs to run over the entire drive, from the fist sector to the last. This means that two copies of a file can be found, the first as a file with its full file and folder name (found as a Filesystem record) and the second as a Lost File (by locating the header and footer of this file in allocated space).

In most circumstances, this type of search would be of limited value. However, you may get a situation where the file system is corrupt and only parts of the file system point to valid files on the disk whilst the remainder do not. In this situation, the ‘allocated’ space would be erroneous, so there would be value in also running a lost file scan over the entire drive.


Troubleshooting

___________________________________________________

FAQ

+ Will Recover My Files run on an Apple Macintosh?

No. Recovery My Files requires Windows to run.

Coming Soon:

Recover My Files will soon support the recovery of Apple Macintosh HPFS file systems.

This means that it is possible to connect a Macintosh formatted drive to a Windows computer and scan it to recover the HPFS Filesystem.

AAAAA
+ What types of Filesystem can Recover My Files recover?

Recover My Files V4 supports recovery from a wide range of Filesystems:

  • FAT16 - an early version of the FAT Filesystem, now rarely used

  • FAT32 - common for external storage media and digital camera equipment

  • exFAT - (Extended File Allocation Table), a proprietary file system suited especially for flash drives

  • GPT - GUID Partition Table, a standard for the layout of the partition table on a physical hard disk

  • NTFS - Standard files system for Windows Vista, Windows 7

  • CDFS - CD/DVD file systems (Coming Soon)

  • MAC - HFS (Coming Soon)

  • EXT2 - Linux (Coming Soon)

  • RAID - RAID JBOD, 0, 1, 5, hardware and software
+ What is best methodology to use to get my files back?

Quick Start Tips

  • Don't panic, most deleted or missing data can be recovered;
  • Minimize the use of your computer until you have had the opportunity to try data recovery software;
  • Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).
Try Before You Buy
Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

  • install Recover My Fils on the C: drive of the 'good' computer, and
  • use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

Troubleshooting

+ General: What Filesystems can be recovered? (e.g. Windows, Mac, Linux)

Recover My Files V4 supports recovery from a wide range of Filesystems:

  • FAT16 - an early version of the FAT Filesystem, now rarely used

  • FAT32 - common for external storage media and digital camera equipment

  • exFAT - (Extended File Allocation Table), a proprietary file system suited especially for flash drives

  • GPT - GUID Partition Table, a standard for the layout of the partition table on a physical hard disk

  • NTFS - Standard files system for Windows Vista, Windows 7

  • CDFS - CD/DVD file systems (Coming Soon)

  • MAC - HFS (Coming Soon)

  • EXT2 - Linux (Coming Soon)

  • RAID - RAID JBOD, 0, 1, 5, hardware and software
+ Activation: Lost Activation Key

If you have lost your Recover My Files activation key, log into your www.getdata.com customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com) where you can locate a record of your purchase, including your activation details.

Login: [the email address used in your purchase]
Password: [if you do not know your password, use the "send me my password" link]
+ Activation: Max Activations Reached
Maximum Activations Reached

A single Standard License of Recover My Files can be used to activate the software on two computer systems owned by the purchaser, e.g. a desktop and a laptop computer.

Recover My Files is "hardware locked" to a computer onto which it is installed. Each time the license is used on a new computer (with a different hardware ID) it counts as an additional activation. When the number of available activations is used, the "Max Activations Reached" message is displayed. This is an anti-piracy measure designed to stop a license of the software being unlawfully activated on multiple computers.

You may also receive this message if:

a) you have changed or added new hardware to your existing PC;

b) you have upgraded your computer and reinstalled Recover My Files software.

In this instance, please contact technical support to request additional software activations.
+ Activation: Upgrade from Recover My Files version 3 to version 4

Upgrade from Recover My Files v3 to Recover My Files v4

A discounted cost applies for existing Recover My Files version 3 customers to upgrade to Recover My Files version 4. Existing version 3 customers:

  • log into your GetData customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com).

    Login: [the email address used in your purchase]
    Password: [if you do not know your password, use the "send me my password" link]

  • once logged in, locate a record of your Recover My Files version 3 purchase and click on the version 4 links;

  • you will see the discounted upgrade price in the shopping cart;

  • checkout and your Recover My Files version 4 key will be displayed on a web page and also sent to you by email.
+ Installation: Am I logged in as local Administrator?

Windows XP:

To check if you are currently logged on as local administrator, right click on the START button. If you see "Open All Users" rather than just "Open," the account is in the local Administrators group.

Microsoft Windows Vista

  1. Click on the Start button.
  2. Select Control Panel.
  3. Make sure your Control Panel window is in Classic View, by insuring that "Classic View" is selected, on the left side of the window.
  4. In the Control Panel window, double click on User Accounts.
  5. You will see information about your account in the window, like this:
  6. On the right of the User Accounts window, you should see your account name, account icon and a description listed.
  7. If the word "Administrator" is in your account's description, then you are an administrator. If you see "Standard user," then you are not an administrator and will need to log in as a different user.
+ Installation: Log in as Administrator on Windows XP

Find Out Which Windows Operating System Your Computer Is Using

1. Click Start, and then click Run.

2. In the box, type winver, and then click OK.

How to login as Administrator in Windows XP?

The built-in Administrator account is hidden from Welcome Screen when a user account with Administrator privileges exists and enabled.

WINDOWS XP HOME EDITION: You can login as built-in Administrator in Safe Mode only.

WINDOWS XP PROFESSIONAL: Press CTRL + ALT + DEL twice at the Welcome Screen and input your Administrator password in the classic logon window that appears.
+ Installation: What version number do I have installed?

What version number do I have installed?

To find this information, at the top of the main program screen in text menu items "File | Recover | Help", click on "Help > About". This will open the program About Box which contains the information.
+ Drive Selection: The drive I wish to search is not listed

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

+ Drive Selection: Learn more about the information displayed in the drive selection window

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

+ File Selection: The file type I am searching for is not in the list

Files Recovery - File type not in list

Help me please.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.
+ Search Progress: The search is very slow - how do I speed it up?

Search speed

In most data recovery situations, you should be able to recover your files within a maximum of 3-4 hours.

There are many factors which can influence the speed of the Recover My Files search. This will include things which you cannot control, such as the size of the hard drive being searched (a 1 terabit drive will take longer than a 250 gigabyte) and the processing speed of your computer. However, however there are also a number of techniques that can be used to obtain maximum recovery in the shortest period of time.

To maintain search speed in "Recover Files" mode:

"Search for deleted files. (Recommended)"

This is recommended option because it is a fast search (less than 1 hour) and may locate your deleted files quickly;

"Search for deleted files, then search for selected Lost File types"

The primary reason that this search will run slow is because more than ten Lost File types have been selected. Select only the important file types first - do NOT select everything.

Whilst the Lost Files search is in progress, monitor the search results screen by clicking between the Folder and File view tabs. If the required files are found and previewed, it is possible to stop the search, save the important files and then resume the search from the same location.

To do this:

  1. Before you stop the search, write down the block number that the search is up to;

  2. Press the stop button;

  3. Click on the OPTIONS button and in the ADVANCED tab place a tick in the box for "prompt for start sector" and "start with Lost File scan";

  4. Click on OK to save these options, then "Start Recovery" > "Drive Recovery" and enter the starting block number.

To maintain search speed in "Recover Drive" mode:

"Automatic Drive Recovery. (Recommended)"

The automatic drive recover is pre-configured to find your files in the shortest period of time.

"Drive Recovery using selected file types"

Only use the selected file type method when your problem drive did not have any of the following file types on it: Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip. When adding additional file types, only add those types essential to the recovery.

In either of these searches, it is not usually necessary to let the search run to the end of the drive:

  • Monitor Folder and File Type views in the search results screen to see if your files have been located;

  • Monitor the number of Filesystem records found is displayed in the progress bar

When the number of "Filesystem Records" found reaches a high number, stops increasing, and remains constant, it means the Filesystem records located have been read (on your average home PC you should reach this point within 2 hours of searching). The average home PC has between 50,000 and 150,000 Filesystem records. Each one represents a file with its full file and folder name.

When you get this point, click the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time) and examine the "Virtual Partition" in Folder view of the results screen.
+ Search Results: Lost Files are all the same size (e.g. 1024kb)

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

  • it is a sequential search of the drive and does not track the fragmentation of files;

  • Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".
+ Search Results: The recovered file does not contain valid data

Does the saved file contain data?

How do I tell?

Open the file and view the raw data inside the file. You can do this by:

  • using a hex editor;

  • using a file viewing tool such as Explorer View for Windows Explorer, www.explorerview.com and examine the file in HEX mode;

  • renaming the extension of the file to .txt and opening the file with Windows Notepad.

No, the file does not contain any data

In some instances a storage device may have powered down (or gone flat) during the save process. This may cause Recover My Files to save blank files, as the data can no longer be read.

If the saved file is blank, you need to change your drive power settings in the control panel:

Control Panel > Power Options > and make sure that the hard drives are not set to power down after a specific period of time (in XP the setting should be "Never").

After you run the search and before you save the files, check that the drive is running by:

    1. Clicking on a JPEG or DOC file in the Recover My Files search results screen - these file types should preview in the bottom windows of the search results screen;

    2. Open Windows Explorer and click on the drive letter of the problem drive (if you have one). Windows will then probe the drive and you should hear the drive spinning up or the drive light flash.

    3. Once the drive is awake, save the files again with Recover My Files and they will save properly. I suggest you first save a small number of files and then open them to test that they have saved correctly.

Yes, the file does contain data but it will not open

If the save file contains data, but does not open, it is corrupt. Try an alternate method to open the file. E.g.

Explorer View:

Explorer View for Windows Explorer is a file viewing program that can view over 300 file types. In many situations it can read corrupt files that will onto open in their creating application.

Photos:

Irfanview (www.irfanview.com) is a free graphics viewer which is good at opening corrupt image files;

Word Files:

Word Repair is a free Microsoft Word repair utility that can extract text from damaged .doc files

PST Files:

Recover My Email (www.recover-my-email.com) is a tool for reading corrupt Microsoft Outlook .PST files

What causes corrupt files?

Files with their original file name

When a file has been found with its original file name, it has been found by locating a File System record for that file which points to the location of the file data on the disk. In a successful recovery, it should be possible to click on the file found in the results window and preview its content, or save the file and open it normally. If the recovered file does not contain valid data, the possible reasons are:

  1. The file system record is pointing to the correct location on the disk, but that section of the disk has been over-written with new data and no longer contains the correct data for this file. In this case, nothing can be done as the original file has been overwritten and destroyed; or

  2. The file system record is corrupt and no longer points to the correct location on the disk. In this case, the additional search for the Lost Files types will attempt to locate the file by its file structure. If the "Search for deleted files, then search for "Lost File" types" option does not locate the file, run a "Lost File" search over the entire drive, by clicking Options > Advanced > and select Start with a Lost File scan and Scan for lost files across the whole device (and not only in the free space). Ensure that you examine all search results start with the name "Lostfile...".

LostFiles

Lost files are located by searching for the header, structure and footer of the file data. Recover My Files performs a series of tests on each Lost File type, to determine the possibility of recovery. Partially corrupt files will be returned as there is the possibility that the files can be accessed using the methods described above.

Contact technical support.


Contact Technical Support

___________________________________________________

Technical Support

Technical support is available by contacting us via the support link at www.recovermyfiles.com. If you need phone support, please be sure to include your contact telephone number where you submit your support ticket. If you are seeking technical advice it will assist if you can provide the following information:

  1. The Version of Windows that you are using;

  2. The Version of Recover My Files that you are using (please use the latest version available for download from www.recovermyfiles.com);

  3. A description of the circumstances under which the files were lost or deleted.

  4. A description of the attempts you have already made to recover files and the result of those attempts. Please attach relevant sample files to your email.


Saving Search Results

___________________________________________________

Saving Search Results

Note: In Recover My Files version 3.98, if the search results screen is closed or a new search is started, the current search results are lost and a new search must be run.

Where can I save Files?

Files must be saved to another drive. This can be another partition on you hard drive (e.g.: Drive "D:\"), another physical hard drive, a floppy disk, USB, ZIP disk, or a network drive writable CD or DVD (this feature is accessed by clicking on the drop down arrow next to the "Save Files" button).

You must activate the program with a product activation key. Learn how to activate Recover My Files here.

How do I select Files to be Saved?

To select a file to be saved, in the file details window place a tick in the box next to the file, as shown in the screen capture below. You can select multiple files to be saved by doing one of the following:

    1. To select a file or folder to be saved, place a tick in the box next to that file or folder.

    2. To select groups of files, hold down the SHIFT key (for groups) or CTRL key (for individual selections), use your mouse to select the files that you require and then press the SPACE BAR key to turn the selection tick on or off.

The default saving option is save the files and folders using the path details in the "Folder" column of the results screen.

Using "Save AS"

Please note that if you click on the drop down arrow next to the "Save Files" button and select "Save As", you will be prompted to assign a name and save location to each file that you have selected to save. If you have selected many files this can be very time consuming. It is recommended that you only use "Save As" if you are saving a small number of files.

When a file is saved, the tick is removed from the list of selected files.

Troubleshooting: Saving Search Results

Problem:

I cannot save recovered files to the same drive on which they were located.

Solution:

It is not possible to save files to the same drive from which the files are being recovered as this process could overwrite and permanently delete yet to be saved files. You must save files to another drive, floppy disk, external storage media, or network drive.

Problem:

I cannot save files to a writable CD or DVD.

Solution:

The ability to write files directly to a CD or DVD was implemented in Recover My Files version 2.93. The option is available by clicking the drop down arrow next the "Save Files" button.

If you receive an error message when attempting to write files to a CD or DVD first try and use a different brand/type of CD or DVD media e.g. DVD+R. If the problem persists, please contact us via the support link at www.recovermyfiles.com and provide:

  1. the exact error message,

  2. the type/brand of CD/DVD media you are using.

Problem:

The files that I have saved are corrupt. I cannot open them.

Solution:

Check the Recover My Files preview window. If you can preview the files here then they can be successfully saved.

Are you saving a "Deleted File". Deleted files have a Recovery Rating. If the Recovery Rating indicates that the files has been overwritten, then it is likely that the file is corrupt and cannot be displayed.

There are a variety of repair utilities for different types of file types (for example, for Microsoft Outlook PST files, run Scanpst.exe to repair the file). Check the Internet for a specific file type recovery tool.


Activation

___________________________________________________

Activation

Accessing the program activation screen

The Recover My Files product activation screen is accessed by clicking on "Help" in the top most menu (not the help button) and then "Activate Product", or by clicking the "Save Files" button:

Product Activation

There are two activation options:

1. Activate Online

Where the computer on which Recover My Files is being installed is connected to the Internet;

2. Activate Manually

Where the computer on which Recover My Files is being installed is not connected to the Internet, another Internet connected computer can be used to collect the necessary information to activate.

In the product activation window (shown above) click on the link to "activate offline manually", then follow the instructions on the screen below:

  1. Use the Internet connected computer to visit the activation web page https://secure.getdata.com/key/key-activation-offline.php ;

  2. Enter into the web page;

    a). The email address used in your purchase;

    b). Your Recover My Files license key; and,

    c). The installation ID from the program activation window.

  3. The Web page will then return a "Registration Name" and an "Activation Code". Enter this information into the Recover My Files product activation window and click next.

Successful Activation

Upon successful activation of Recover My Files, you will see the following screen:

Once activated you have the ability to save recovered files.

Troubleshooting Program Activation

+ Activation: Lost Activation Key

If you have lost your Recover My Files activation key, log into your www.getdata.com customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com) where you can locate a record of your purchase, including your activation details.

Login: [the email address used in your purchase]
Password: [if you do not know your password, use the "send me my password" link]
+ Activation: Max Activations Reached

A single Standard License of Recover My Files can be used to activate the software on two computer systems owned by the purchaser, e.g. a desktop and a laptop computer.

Recover My Files is "hardware locked" to a computer onto which it is installed. Each time the license is used on a new computer (with a different hardware ID) it counts as an additional activation. When the number of available activations is used, the "Max Activations Reached" message is displayed. This is an anti-piracy measure designed to stop a license of the software being unlawfully activated on multiple computers.

You may also receive this message if:

a) you have changed or added new hardware to your existing PC;

b) you have upgraded your computer and reinstalled Recover My Files software.

In this instance, please contact technical support to request additional software activations.
+ Activation: Upgrade from Recover My Files version 3 to version 4

Upgrade from Recover My Files v3 to Recover My Files v4

A discounted cost applies for existing Recover My Files version 3 customers to upgrade to Recover My Files version 4. Existing version 3 customers:

  • log into your GetData customer account here: https://secure.getdata.com/my/ (or using the 'Member Login' link in the footer of any GetData web site such as www.recovermyfiles.com).

    Login: [the email address used in your purchase]
    Password: [if you do not know your password, use the "send me my password" link]

  • once logged in, locate a record of your Recover My Files version 3 purchase and click on the version 4 links;

  • you will see the discounted upgrade price in the shopping cart;

  • checkout and your Recover My Files version 4 key will be displayed on a web page and also sent to you by email.


Automatic vs Manual Drive Recovery

___________________________________________________

Drive Recovery

--------------------------------------------------------------------------------

© Copyright GetData 2009

Data Recovery Software | www.recovermyfiles.com


Defention - Logical and Physical Drives

___________________________________________________

Logical Drives (Drive Letters) v's Physical Drives (Hard Disks)

Physical Drives:

A Physical drive refers to the actual physical hard drive that you have connected to your computer system. For example, if you had three hard drives connected to your computer, you could expect to see "0 Physical", "1 Physical" and "2 Physical" listed in the drive selection window (a computer starts counting the drives from the number "0").

By selecting a Physical drive to search, you are telling Recover My Files to ignore all drive letters ("Logical" drives) on the hard disk and treat the drive as one large amount of raw data.

Searching the physical drive is recommended when recovering from a drive partitioning or formatting error. Selecting the physical drive ensures that you are searching the entire storage media.

If you have more than one physical drive connected, the displayed drive sizes in the Recover My Files drive selection window should give you enough information to select the right drive to search.

Drive Letters ("Logical" Drives)

Any drive letters displayed by Windows will also be recognized by Recover My Files. A drive letter, eg. C: is a partition located on a "Physical" drive. A Physical drive can have more than one partition, e.g. drives C:\, D:\ and E:\ could all exist on the one physical hard drive.

The C:\ drive on which Windows is installed is usually located on Physical drive 0.

By selecting to search a drive letter, you tell Recover My Files to search only the space on the hard drive allocated to that drive letter by Windows. For example, if you have a 40gb partition called drive C:\ which exists on a 100gb drive and you select to search the C: drive, then Recover My Files will only search the 40gb.

Note: It is NOT NECESSARY to search a drive letter as well as the 'physical' drive on which that drive letter exists. This will cause the program to search the same disk twice, and slow down the search process.


Definition - Lost File

___________________________________________________

Definition of a " Lost File A file that has been deleted which no longer has a File System record, but the content of the file remains on the disk and can be recovered. Lost files are located using a technique refered to as "data carving", by searching for the unique header, structure and footer of the file type. "

"Lost Files" are files for which the Microsoft Windows file reference information that was once used to find the location of the file on the hard disk has been destroyed. However, the data that made up the contents of the file can still located on the hard disk.

Recover My Files performs a disk scan to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). Whilst the data can be recovered, the Microsoft Windows file name cannot. Recover My Files gives a Lost File the name " Recovered_[filetype]_1" and will increment the number according to how many lost files are found for that file type.


Definition - Deleted File

___________________________________________________

Definition of a "Deleted File"

"Deleted Files" are those file for which the Microsoft Windows Operating System file reference information remains intact. This file reference information can be used to find the location of the deleted file and access it. "Deleted Files" retain there original file name and folder structure.

When searching for a "Deleted File", Recover My Files reads the Microsoft Windows File Allocation Table (FAT) or Master File Table ( MFT On NTFS formatted drives, a table at the start of the drive called the "Master File Table". This table is like a spreadsheet and contains a record of every file on the drive, including recently deleted files. The MFT record tells Microsoft Windows the name of the file and the location of the file on the disk. ) to determine if the space used by the deleted file prior to its deletion is now being occupied by other active files. As only one file can occupy a storage space at any one time, if this happens the deleted file has been overwritten, or partially overwritten, and that part of the deleted file has been destroyed. Recover My Files displays this in the following rating system:

Overwritten: The original file has been completely overwritten and cannot be recovered.

Poor: the search indicates that between 1% and 50% of the file can be recovered.

Medium: the search indicates that between 51% and 90% of the file can be recovered.

Good: the search indicates that between 91% and 99% of the file can be recovered.

Very Good: the complete file can be recovered.

Whilst this rating system is a good indication of the chance of recovery, a preview of your file, if available, is the definitive way to determine if your file can be recovered.


Defenition - Deleted File Recovery Rating

___________________________________________________

"Deleted File" Recovery Rating

When searching for a "Deleted File", Recover My Files reads the File Allocation Table (FAT) or Master File Table ( MFT On NTFS formatted drives, a table at the start of the drive called the "Master File Table". This table is like a spreadsheet and contains a record of every file on the drive, including recently deleted files. The MFT record tells Microsoft Windows the name of the file and the location of the file on the disk. ) to determine if the space used by the deleted file is being occupied by other active files. As only one file can occupy a storage space at any one time, if this happens the deleted file has been overwritten, or partially overwritten, and that part of the deleted file has been destroyed.

The rating system is as follows:

Unknown: It is not possible to determine the recovery rating of the file. Click on the file to see if it will preview.

Overwritten: The original file has been completely overwritten and cannot be recovered.

Poor: the search indicates that between 1% and 50% of the file can be recovered.

Medium: the search indicates that between 51% and 90% of the file can be recovered.

Good: the search indicates that between 91% and 99% of the file can be recovered.

Very Good: the complete file can be recovered.

Whilst this rating system is a good indication of the chance of recovery, a preview of your file, if available, is the definitive way to determine if your file can be recovered.


Deleted vs Lost files

___________________________________________________

The "Recover Files" search

Searching for Deleted Files and Lost Files

The next wizard window presents the following two search options:

1. "Search for Deleted Files"

Microsoft Windows keeps a table on the drive which lists the name and location of every file stored on the drive, including deleted files. Microsoft's first version was called the "File Allocation Table" (FAT), but it has been superseded by a new format for NTFS formatted drives called the "Master File Table" (MFT).

A Deleted Files is a file that has been marked as deleted by the Windows Operating System, but which retains sufficient information stored in the FAT or MFT to be fully recovered with its original name and folder location.

This search is "Recommended" because:

  • It will rapidly scan the FAT or MFT for deleted files;
  • If files were recently deleted, there is a high probability of success;
  • Files located will have their original names and folder structure intact.

When this option is selected, press "START" to commence the search. (NB: If files are not located, return to this screen and run the second search)

2. "Search for deleted files, then search for Lost Files using selected "Lost File" types

Following a file deletion, subsequent activity on the computer may lead to records in the FAT or MFT for these files being destroyed. A "Lost File" is a file that has been deleted which no longer has a Windows Operating System record stored in the FAT or MFT, but the content of the file remains on the disk and can be recovered.

Recover My Files has the capability to performs a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

When this option is selected, click "Next" and the following screen is presented:

Select the file types to search for by placing a tick in the box next to the file type.

The more file types that are selected, the more resource intensive is these search and the longer the search will take. It is suggested that you do not perform a lost file search for more than 10 files at any one time.

A "Lost File" search is a sequential search of the entire hard drive. A sequential search of a large hard drive, e.g. 1TB or more containing many files may take up to 24 hours.

It is suggested that you perform this search when:

  • The recommended "Search for deleted files" option did not find your files;
  • When you wish to be certain that all possible data on the drive can be located and recovered.


RAID - Overview

___________________________________________________

RAID Overview

Recover My Files v4 can recover the following types of RAID:

JBOD

JBOD (Just a Bunch Of Disks) is a term to describe the grouping of odd-sized drives into one larger useful drive. Fore example, a JBOD could combine 3 GB, 15 GB, 5.5 GB, and 12 GB drives into a logical drive at 35.5 GB, which is often more useful than the individual drives separately.

RAID 0

A RAID 0 (also known as a stripe set or striped volume) splits data evenly across two or more disks (striped) with no parity information for redundancy. It is important to note that RAID 0 was not one of the original RAID levels and provides no data redundancy. RAID 0 is normally used to increase performance, although it can also be used as a way to create a small number of large virtual disks out of a large number of small physical ones.

A RAID 0 can be created with disks of differing sizes, but the storage space added to the array by each disk is limited to the size of the smallest disk. For example, if a 120 GB disk is striped together with a 100 GB disk, the size of the array will be 200 GB.

RAID 1

RAID 1 is a mirrored set with parity. Typically, it consists of two physical drives, one being an exact copy of the other. The RAID Array continues to operate so long as at least one drive is functioning. Using RAID 1 with a separate controller for each disk is sometimes called duplexing.

RAID 5

A RAID 5 uses block - level striping with parity data distributed across all member disks. Distributed parity means that if a single drive fails the array is not destroyed. Upon a drive failure, any subsequent drive reads can be calculated from the distributed parity of the functioning drives. A single drive failure in the set will result in reduced performance of the entire set until the failed drive has been replaced and rebuilt.


Recover Files - Selecting the Drive to Search

___________________________________________________

Recover Files

Selecting the Drive to Search

The drive selection window lists the available drive letters to search. It is possible to search only one drive letter at a time.

Select the drive letter to search by clicking it with your mouse, then click "Next" to move to the next wizard window.

Trouble Shooting: File Recovery Drive Selection

Problem: The drive I wish to search is not listed.

Suggestion: Try the following:

    1. Check connections

      Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

      Is the drive now showing in Windows Explorer? If so, click the "Refresh" button to re-display the available drives in Recover My Files.

    2. Is the file system damaged?

      It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

    3. Are you connecting directly to a digital camera?

      Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter.

      In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

    4. Are you trying to connect to an iPod Touch, iPhone or similar device?

      Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

For more information or assistance, contact GetData via the support link at www.recovermyfiles.com.