Drive Recovery - Results Screen

A Drive Recovery is targeted at the recovery of partitions from a formatted, corrupt, raw or unallocated hard drive. A successful recovery should locate and display the full file and folder structure in the search results screen.

In a "Recover Drive", it usually the "Folder" view which has most relevance, as it displays the file and folder structure of the recovered files (shown as area 4 in this screen-shot). Drive recovery results fall into three categories:

Recovered Partitions

When a valid existing partition is located on a drive it is represented in Folder view as follows:

The description of this partition is:

"@ 32256" represents the sector on the drive where the partition was located
"[NAME]" (if present) represents the volume name of the partition
"(2)" represents the number of sub folders that it contains.

Click on the + sign to expand the partition to view the sub folders that it contains. Click on individual files to display the properties for the selected file and a preview of the file.

Recovered Virtual Partitions

A virtual partition is essentially the old underlying partition on a drive. For example, when a hard disk is formatted and Windows is reinstalled, the existing new installation of Windows will be recovered as the active partition (described above) with the old underlying partition recovered as the virtual partition. A virtual partition is represented in Folder view as follows:

Virtual Partition(FAT) - represents the type of partition located
"@ 19513856" represents the sector on the drive where the partition was located
"[NAME]" - (if a name exists) represents the volume name of the partition
"(180)" represents the number of sub folders that it contains.

Click on the + sign to expand the partition to view the sub folders that it contains.

Sometimes incomplete or 'ghost' partitions can be located. Each partition shown in "Folder" view should be checked to see if it contains valid data. The primary test is whether individual files contained in the recovered partition is whether individual files can be displayed in the preview window.

Lost File Results

In Drive Recover mode, 'Lost Files' are the file types that were selected (either pre-selected in automatic mode, or manually selected) to aid in the identification of the file system. They are represented in Folder view as:

"(92)" represents the number of files that it contains.

Click on the + sign to expand the partition to view the files that it contains.

If the recovery of partitions was NOT successful (or only partially successful), Lost Files can be important as they will still give access to your lost data (but without original file names or folder structure). Learn more about Lost Files here.

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

it is a sequential search of the drive and does not track the fragmentation of files;
Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

If partition recovery was not successful, it is suggest that you run a second drive recovery, using selected file types, to find your important files.

The Recover My Files search results screen is broken down into 8 areas, as shown in this screen-shot.

The search progress area (shown in the screen-shot as area 3) contains important information about the search.

In a File recovery, the 'Files Found' number represents each Deleted File and each Lost File found.

What is a Lost File?

A Lost File is one that has been deleted, but which no longer has a Windows Operating System record in the FAT or MFT. Windows no longer knows about this file, but content of the file remains on the disk and can be recovered.

Lost files are located using a technique referred to as "data carving".

Data carving is the technique of recovering files based on content. Recover My Files examines the header, content and footer of a file to determine if it matches a known structure, e.g. JPEG, TIF, XLS, DOC etc.

The limitation of data carving is that;

the original file name is not recovered as this information is stored only in the FAT or MFT and is not stored with the file data;
to identify a Lost File, the file format must be understood and included in the list of Recover My Files available file types.

What is a "Deleted File"

On a computer storage device, the term 'Filesystem' is used to describe the schema by which electronic files are stored. A common characteristic of a Filesystem is that they use a table on the drive to track every file on the disk, including user deleted files. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

The first version of this table in Microsoft was called the "File Allocation Table" (FAT), but more recently released a new table format called the XFAT, and for NTFS formatted drives, the "Master File Table" (MFT). When a file on the drive is deleted, the FAT or MFT record is marked as such and can be used to find the location of the deleted file and recover it, including the original file name and folder location.

In Drive recover mode, the 'Files Found' number represents each Lost File found and each file found in a recovered partition.

What is a Lost File?

Lost files are located using a technique referred to as "data carving".

The limitation of data carving is that;

the original file name is not recovered as this information is stored only in the FAT or MFT and is not stored with the file data;
to identify a Lost File, the file format must be understood and included in the list of Recover My Files available file types.

Filesystem records indicate where a missing Filesystem has been found. Each Filesystem record represents a file with its full file and folder name.

The Filesystem records number can be used as a guide to identify when a Drive Recovery can be stopped (without the need to let the search run to the end). Learn more about Filesystem records here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.

Recover My Files makes search results available under four different views, access by clicking on the following tabs (as shown in area 2 of this screen-shot):

Folder view

The "Folder Tab" is used to display the file and folder structure of the search results and is similar to how Windows displays the files and folders in Windows Explorer. Learn more about the Folder tab here.

"Folder" Tab

The "Folder Tab" is used to display the file and folder structure of the search results and is similar to how Windows displays the files and folders in Windows Explorer.

In File Recover mode, it displays the file and folder structure of Deleted Files.

In Disk Recover mode, it displays the files and folder structure of recovered partitions.

When files are selected and save from Folder view, the folder structure of the saved files will replicate what is displayed here.

File Type view

File Type view lists files according to their extension. This can be used as a fast way to locate a file when the type is know but the original folder location is not. The "Other Extensions" folder contains all other file extensions not specifically selected in the search.

Date Tab

The Date tab sorts search results file date. This can be useful to quickly locate digital camera pictures and other files that were known to be created at a specific point in time.

The date used in the sort is changed by selecting one of the following tabs at the bottom of the window:

Create date - the date that the file was created;
Modified date - the date the file contents was last changed;
Accessed date - the date that the files was last accessed (by either a user or a program).

Find

The Find tab is used to search through the existing search results for relevant files based on your selected search criteria. Learn more about the Find tab Learn more about the Find Tab here.

"Find" Tab

The Find tab is used to search through the existing search results for relevant files.

A find can only be run once a search is completed.

The file preview are is in three windows: 5a, select the individual file; 5b, view the file properties; and 5c, preview the file (see screen-shot). The preview windows may display the following messages:

"A preview is not available for this file type": Recover My Files has examined the file header and determined that the file types does not support a preview;

"Corrupt file, preview not available": Recover My Files has examined the file header and determined that it is a file type that can be previewed, however the data inside the file is damaged and a preview of the file cannot be displayed. It is unlikely that when a file that displays this message is saved that it will open properly.

The bottom left hand corner of the search results screen identifies if "Files Recovery" or "Drive Recovery" mode was selected.

Displays the logging mode that is currently being used. Logging is displayed in the Event Log tab in section 5a (as shown in this screen-shot).

Debug Logging: Debug logging gives additional information about the recovery process. Debug logging is resource intensive and will slow down a search. It is recommended that you only use debug logging mode when instructed to do so by GetData support staff. Right click on the log screen to copy the information to the windows clipboard.

This shows the number of files selected to be saved and the total size of the files selected, e.g. "Selected items 25 (22.3mb)". In this example, a minimum of 23 megabytes is required on an external drive to save the files. Learn about saving files here.

The duration of the search is displayed in the bottom right hand corner of the main program screen.