The "Recover Files" search

Searching for Deleted Files and Lost  Files

The next wizard window presents the following two search options:

1. "Search for Deleted Files"

Microsoft Windows keeps a table on the drive which lists the name and location of every file stored on the drive, including deleted files. Microsoft's first version was called the "File Allocation Table" (FAT), but it has been superseded by a new format for NTFS formatted drives called the "Master File Table" (MFT).

A Deleted Files is a file that has been marked as deleted by the Windows Operating System, but which retains sufficient information stored in the FAT or MFT to be fully recovered with its original name and folder location.

This search is "Recommended" because:

• It will rapidly scan the FAT or MFT for deleted files;
• If files were recently deleted, there is a high probability of success;
• Files located will have their original names and folder structure intact.

When this option is selected, press "START" to commence the search. (NB: If files are not located, return to this screen and run the second search)
 

2. "Search for deleted files, then search for Lost Files using selected "Lost File" types

Following a file deletion, subsequent activity on the computer may lead to records in the FAT or MFT for these files being destroyed. A "Lost File" is a file that has been deleted which no longer has a Windows Operating System record stored in the FAT or MFT, but the content of the file remains on the disk and can be recovered.

Recover My Files has the capability to performs a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

When this option is selected, click "Next" and the following screen is presented:

Select the file types to search for by placing a tick in the box next to the file type.

The more file types that are selected, the more resource intensive is these search and the longer the search will take. It is suggested that you do not perform a lost file search for more than 10 files at any one time.

A "Lost File" search is a sequential search of the entire hard drive. A sequential search of a large hard drive, e.g. 1TB or more containing many files may take up to 24 hours.

It is suggested that you perform this search when:

• The recommended "Search for deleted files" option did not find your files;
• When you wish to be certain that all possible data on the drive can be located and recovered.