File System Issues and Compatibility
Problems and Solutions with lost files
Problems
and Solutions with lost files
A file found by the help of a file signature search algorithm is called 'lost'. These files can be found on drives without any file system data, or on a single drive after performing the Deleted File Recovery scan. Typically, these type of files can only be recovered if they are stored in one or consecutive clusters on the drive. Heavy fragmentation on the drive will adversely affect the recovery.
If the file size of these lost files could not be detected, they will assigned a default size specified internally to the program. The default size maybe too small for the detected file, e.g. if a bitmap file could be detected but the image is cut off at a position. In this case the size of the found lost file is too small and you can adjust the size for each single file by selecting Resize from the Expert menu. It does not matter if you specify a size above the real size of the file since most file types store their own correct size in the file.Another problem can occur if the recovered file is using an OLE Storage Format that is used by file formats like Microsoft® Word, Excel, PowerPoint, and many third party vendors. In this case FILERECOVERY® tries to detect the correct extension and rename the extension (e.g. to .DOC, .XLS or .PPT). If that fails the file extension will remain '.MOF'.
In Windows® 2000 & higher, whenever an entry (file or folder) is deleted the higher order word of the 32-bit starting cluster is erased by the operating system. Hence the correct value of the starting cluster at the time of recovering the entry is not known. Without the exact knowledge of the starting cluster no recovery tool can find out and successfully undelete a deleted entry. To overcome this problem FILERECOVERY® has devised a solution. Depending on the size of the disk, it generates probable starting cluster values of the file/ folder selected for undelete . In case of a folder the program will automatically try all multiple combinations which may result in a delay during reading process - in case of a file it will ask the user to test each of the multiple combinations.
It has been seen that the file system driver in the case of NTFS drives tries to optimize the space used by the MFT by resizing it during each time the system is switched on. Once the MFT has been resized (if downsized), it is not possible to recover all the deleted entries.
HFS/HFS+ Problems
and Solutions
Mac OS X uses the HFS/HFS+ (Hierarchical File System) for storing data on the hard drive. This is very different than the FAT or NTFS used by Windows®. The Mac HFS/HFS+ file system uses journaling to minimize data loss. Basically, journaling involves tracking all of the changes made on the files in a volume on the Mac. Normally, this journal file can be used by the system to revert to a previous state of the data on the hard drive. However, in some cases, this journal file can be corrupted and reverting the system will be unsuccessful. Full recovery of the path and file names may not always be possible, but the data may still be recoverable. Using the Deleted File Recovery with the RAW selection checked will recover a large amount of this type of lost data.
Deleted
files from Recycle Bin under Windows®
When a file is sent to the Recycle Bin under the NTFS operating system, the file name is no longer preserved. The files will be renamed into 'D drive letter deleted file#'.
When recovering files that have been removed from the recycle bin (folder 'RECYCLER') look for 'D' followed the drive letter of the original file, followed by a number. For example, a file deleted from the E: drive may be named 'DE10.DOC', a deleted file from C: drive may be named 'DC.XLS'. The file extensions will be preserved as well as the deleted date. This rule does not apply to files which have been deleted from The Command Prompt or from within applications, they will retain their file names.
Deleted
files from Recycle Bin under Mac OS X
When a file is deleted under the Mac OS X operating system, the file is moved to the trash bin. Once the file has been removed from the trash, the name is completely wiped from the HFS+ file system. The only way to recover the data is to look for the raw bits and bytes of the file using the file signature search algorithm. Therefore, it is very important to make sure when scanning a Mac volume for deleted data, the RAW analyzer option is always selected.
NTFS encrypted
and compressed files
When saving compressed files, guarantee that you are using a Windows® NT-based operating system that supports compression (Windows® 2000/XP). Otherwise the compressed files can not be decompressed and will be saved in a compressed format using the extension '.$compressed'. Files with this extension can be imported later under NT-based operating system uisng the additional FILERECOVERY® tool 'comimport.exe'.
When saving encrypted files, guarantee that you are using a Windows® NT-based operating system that supports encryption (Windows® 2000/XP) and save the recovered data to a NTFS drive. Otherwise the encrypted file can not be decrypted and will be saved in a packed raw encrypted format using the extension '.$efs'. Files with this extension can be imported later to a NTFS drive using the additional FILERECOVERY® tool 'efsimport.exe'.
If you have recovered an encrypted file of a user whose account is no longer available or who loses his private key (e.g. due to a system crash) you may use one of the following solutions to read the data again:
- Use the Windows® NT Certificates snap-in to import the user's Certificate to read the file. This presupposes that you have exported the user's certificate before.
- Recover the file as Recovery Agent (encrypted files are encrypted with the user's key and a Recovery Agent's key, a delegated person whose account is configured as Recovery Agent).
The recovery agent can go to the machine with the encrypted file and load his recovery certificate and private key and perform the recovery on the machine.
NOTE: In a small business or home environment where there are no recovery agents, recovery can be done on a stand-alone computer itself using the local administrator account, which is configured as the default recovery agent.- Back up your encrypted files (using Microsoft Backup) to a .bkf file and send the .bkf file to the Recovery Agent's computer. The Recovery Agent should restore the files on a secured system, decrypt them and send them back to the user.
Refer to your Windows® operating system manual to get more information on decrypting encrypted (encryption recovery) files that have been saved to a NTFS drive.
FILERECOVERY® is compatible with all Windows® and Mac OS X file systems. There may be some problems with the way FILERECOVERY® accesses the disk and some antivirus, adware, and anti-spyware tools may report an error. For best usage, disable or uninstall any antivirus, adware, and anti-spyware tools before running FILERECOVERY®.
FILERECOVERY® is also compatible with ISO9660 and EXT2/3 file systems as well as drives with no file systems (RAW).
FILERECOVERY® cannot recover data from physically broken drives and devices. These can sometimes be sent in to our lab for recovery. For more information on that, please contact us here.
FILERECOVERY®
is a registered trademark of LC Technology International, Inc
Microsoft
and Windows are trademarks of Microsoft Corporation. All other trademarks are
the property of their respective owners.