Drive Recovery

A drive recovery will attempt to recover, if possible, all files on the drive with their complete file and folder structure.

Quick Start Tips

Don't panic, most deleted or missing data can be recovered;
Minimize the use of your computer until you have had the opportunity to try data recovery software;
Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).

Try Before You Buy

Run Recover My Files in evaluation mode. If you can see your files (view the photos and read the documents) in the search results screen, then purchase an activation key to save them (you do not need to run a second search).

What is the best way to run Recover My Files?

Ensure that you install and run Recover My Files with full administrator rights. This is needed for low level disk access to recover your files.

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

install Recover My Fils on the C: drive of the 'good' computer, and
use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

The "Recover Drive" options is best used when:

a drive has been formatted;
a drive has been formatted and windows has been reinstalled;
a Windows recovery or system restore has resulted in a fresh installation of Windows and the previous user created files are missing;
a drive letter has gone missing;
the drive is recognized by your PC as RAW and not files can be read;
or some other problem has effected the entire contents of the drive.

To recover a drive, click the "Recover Drive" button then "Next" to proceed. (Note: If your data loss problem relates to the deletion of individual files, select instead try the "Files Recovery" option).

In the example below, and external 75GB USB hard drive containing photos has been accidentally formatted. The drive contained one partition only which was the size of the entire drive. Clicking on the drive letter in Windows Explorer shows that it no longer contains any files.

Selecting the Drive to Search

When running a "Recover Drive" it is usually best to select and search the entire "Hard Disk" (learn when to select the drive letter).

Select "Hard Disk #" by clicking it with your mouse (as shown in blue below), then press "Next".

+ Drive Selection: Learn more about the information displayed in the drive selection window.

The drive selection window displays the following information:

· logical drive letter, e.g. "C:"

· the drive label (if no label has been give it will display "{no label}"

· the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

· the format of the drive, e.g.

§ NTFS

§ FAT

· describes the way in which the drive is connected to the computer

§ SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§ ATA - an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§ 1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§ SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§ Fibre - Optic Fibre connection

§ USB - USB connection

§ RAID Types

o JBoD

o RAID 0

o RAID 5

· describes the means by which the drive is being accessed

§ S - SCSI Pass Through Interface

§ W - Windows

§ F - File

§ T - TCPIP

§ M - Mixture of the above types

Options in the drive selection window include:

This button is used in for RAID recovery. Learn more here.

This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

This button refreshes the list of available drives to search.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter. In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Recover Options, Automatic or Selected File Types

The following screen presents two drive recovery options:

"Automatic drive recovery. (Recommended)"

During an automatic drive recovery, certain pre-selected file types are used to assist in locating the missing file system. Recover My Files searches for these file types by locating the header / structure and footer and then uses the information found to help pinpoint the missing file system. These files are called "Lost Files"

In Automatic mode, the pre-selected Lost Files types are Avi, EXE, iTunses, Jpeg, Microsoft Excel and Word and Zip files (during an "Automated drive recovery", click on OPTIONS > FILE TYPES to view the pre-selected file type).

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

it is a sequential search of the drive and does not track the fragmentation of files;
Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".

"Drive recovery using selected file types"

This option allows the user to manually select the file types to assist in locating the missing Filesystem.

It is suggested that you only use this option to change the pre-selected file types if you do not have any of the pre-selected file types on the problem disk. For example, if the problem drive had only HTML files on it, it would be necessary to select the HTML file type.

In most cases the common pre-selected file types will be adequate and additional file type selections will NOT be required to locate the entire file and folder structure containing all files.

You may consider adding it to the list if you have a specific file type that is essential to recover. The benefit of adding a file types is that in addition to helping locate the file system, you are simultaneously searching for the Lost File type by looking for its header, structure and footer. If the file system has been destroyed and cannot be recovered, you may still find the important file as a Lost File. However, be aware that adding file types will slow down the search. We suggest that you do not select more than 10 file types at any time.

Drive Recovery - File type not in list

A Drive Recovery is targeted at the recovery of full Filesystem, with all files and folders. Selected files are used by Recover My Files as an aid to locating the Filesystem records.

If a specific file that you wish to recover is not in the list, it is of no consequence if you can select other files from the list that were also present on the problem drive.

Adding a File Type to Recover My Files

Adding a Lost File file type to Recover My Files requires a full understanding of the file structure. Some file structures are publicly documented, most are not. Depending on the file type, it can be a complex and time consuming task.

To request a file type to be added, contact technical support and provide as much information about the file type as possible, including the author web site and the version number of the program used to create the files (if applicable). Also send 3 sample files from your system. GetData will then advise if it is possible to add the file type and how long it will take.

Search Phase 1 - Partition Recovery

Phase 1 of the search attempts to locate and rebuild then entire lost partitions:

Partition recovery should take between 1 - 45 minutes to complete (depending on the size of the drive, the number of files that it contains and the speed of the computer / drive). Learn about steps within phase 1 - partition recovery.

If partitions are located and can be recovered, all of the missing folders and files structure will be displayed under "Folder" view at the end of Search Phase 1 (in order to find and display the full file and folder structure, it is necessary that the search be allowed to fully complete this phase).

A recovered partition is shown in "Folder" view of the results screen as:

Whilst the search is in progress, expand the recovered partition (using the '+') to determine if your missing files have been located. If they partition was found and you can click on your missing files and preview their content, STOP the search and save your files.

Learn more about the Drive Recovery search results screen here.

Search Phase 2 - Searching for File System records (FAT/XFAT/MFT) using selected file types

Once Phase 1 of the search is complete, Phase 2 of the search will automatically commence. Phase 2 uses the selected file types to help locate file system records on the drive.

The number of file system records found is displayed in the progress bar. Each Filesystem Record represents a file with its full file and folder name:

If you are in a hurry to recovery your data:

When the number of "Filesystem Records:" found reaches a high number (an average home computer has between 50,000 and 150,000 Filesystem records), stops increasing, and remains constant, it means the file system records located have been read. On your average home PC you should reach this point within 2 hours of searching. You can press the STOP button (note down the 'block' number that the search is up to in case you wish to recommence the search at a later time);

or, if time is not a concern to you, let the search run to the end.

Once you have stopped the search, or the search finishes, the search results will build and display in "Folder" view of the results screen as a "Virtual Partition". A virtual partition is displayed in the results screen as:

Expand the search results (using the '+') to determine if your missing files have been located.

Learn more about the Drive Recover search results screen here.