TOC · Work · Menu · Tools

Data Recovery

Damaged Devices   Removed Files   Encrypted Files   Complex Scan

Attention! Make sure the device is not damaged beforehand (if device is damaged).

Attention! Do not write anything to the source disk. Recover data to another disk only. It is highly recommended to recover data to another physical device. You may recover to another partition of the same device only if you are sure that the source and destination partitions don't overlap and the device has no physical problems. Do not load system or run software from the partition where lost data is located (Installation and Run).

Attention! If files are recovered incorrectly or there are other problems make sure you are using the most recent software versions from a trusted source.

Data Recovery Steps

With Free Edition you may recover up to 4000 files from the current panel per single command call (you should first open a directory with the necessary files on a panel and then select recovery from the panel).

If you cannot open/play files after recovery you should try different found volume variants - return to the Full Scan results or to Partitions and open the next found volume.

Dialog Box "Recover"

File Categories

Select file categories for recovery - see File Panel for categories details. During the traversal the checkboxes for excluded files will be unchecked unless the option "keep selection marks for excluded items" is selected.

Button "Size"

Calculate the size of the data to recover. Global indicator of recovery process is working if the size is calculated. You should not calculate the size to avoid unnecessary device load on devices with bad sectors.

Button "List"

Create a list of selected files. It is also possible to list sectors occupied by files (data recovery restrictions are applied if Free Edition is used), certain sector ranges can be specified.

Checkbox "Include NTFS altstreams" (Professional Edition only)

Recover NTFS alternate data streams. Alt. streams are displayed in the File Panel after FS reconstruction, an alt. stream name is separated by a colon.

Filters

Name, size, date of modifications filters are supported. During the traversal checkboxes for excluded files will be unchecked unless the option "keep selection marks for excluded items" is selected. Use 0 (zero) as a second value for the size if you wish to limit a lower size only.

Name masks are semicolon separated. Wildcards "*" (any set of chars) and "?" (any char) are supported. Exclusion masks may also be defined by prepending a backslash "\". Masks at the beginning have a priority. E.g. the name abc.tmp matches a*;\*.tmp and does not match \*.tmp;a*.

Create Report (Professional Edition only)

Save recovery report to a file. List files and directories, log file I/O errors, calculate checksums CRC32, MD5, SHA1 for a forensic report.

Additional Issues

Checkbox "Unicode names"

The option is marked by default for OS supporting Unicode. If it is unchecked then symbols outside the selected code page must be transliterated or substituted (see Locales). Unavailable in DOS.

Recover to a FAT formatted volume, checkbox "Split large files"

FAT volumes do not support files greater than 4GB (or sometimes 2GB). Larger files may be split during recovery upon a request if OS properly reports (which is not always the case) or if the option Split large files is used (preferable). Later you may merge file parts on another disk by using the system utility copy /b part1 + part2 + part3 result, for example. Pure DOS supports only FAT volumes.

File names in DOS, checkbox "Substitute names"

Without special drivers long files names are not supported under DOS. Option Substitute names allows name substitution during recovery. File LRENAME.BAT is being created in the destination folder for backward renaming. To restore original file names load OS Windows, go to the destination folder and execute the file LRENAME.BAT. An appropriate OEM code page must be selected when working in DOS in order to restore national symbols correctly. Unicode symbols outside the selected code page will be transliterated or substituted.

You may add the parameter substnamesutf8=1 or use the option utf-8 to create LRENAME.BAT in the utf-8 format fully supporting Unicode regardless the selected code page. Utf-8 format is supported in Windows 7 and higher.

Paths longer than 259 symbols (Windows NT and higher)

Support for extra long paths option (or manual prepending the prefix \\?\ when specifying the destination directory, e.g.: \\?\D:\) allows recovering paths longer than 259 symbols. Such long paths may be inaccessible using standard OS means such as Explorer ("My Computer").

Duplicate Names and Other Events Handling

During recovery there may be name duplicates if there different versions of the same file/directory are found, if the destination file system doesn't distinguish between some names whilst the source FS distinguishes, if there are already files on the destination path before recovery.

If the OS reports the file/directory exists already you are prompted to choose how to handle the duplicate. You may rename/skip the object manually or choose the "auto rename" or "skip all" options to automatically handle all subsequent objects too. It is also possible to merge directories with duplicated names.

Additionally you are asked for a threshold (maximum number of duplicates for the same name). When the threshold is exceeded you are asked again for a desired action. Parameters maxfilerenames= and maxdirrenames= are used as default threshold numbers.

The destination file system designates duplicates. Duplicates are not handled if name substitution is used under DOS.

Event Handler...: preset recovery events handlers (duplicate names, I/O errors, and others).
The option Skip causes skipping recovery of a file or directory if the corresponding event occurs.
The option Ignore means the recovery will be continued ignoring the event.
The option Ignore and Hide means the recovery will be continued and the recovered file will be hidden (more exactly, the attribute "Hidden" will be set for the file in Windows / DOS, or zero 0 permissions (not accessible) will be set in Linux / macOS).
The option Move to $Bad will move the recovered file inside the directory $Bad created in the destination directory.

NTFS Encrypted Recovery

DMDE recovers NTFS encrypted files without decryption. An encrypted file contains the encrypted data and encryption key which in its turn is encrypted with a certificate key. You need the certificate from the source OS or its backup to be installed on a destination OS to open encrypted files after recovery. Please refer to Microsoft documentation on exporting and importing certificates.

To store encrypted files NTFS encryption (EFS) must be supported by both OS and the destination file system (i.e. Windows and NTFS are required). In DMDE there are workaround options for EFS recovery when run on a different platform.

Recover to separate streams: recover data streams and keys into separate files (.efs and .efk extensions are assigned). Further processing of these files is a user task.
Recover to backup (portable format): recover file data and key into a backup file (.efb). Backup files may later be restored into EFS files using the menu Tools - Restore EFS from Backup... (only when run on a EFS supporting platform).
Recover to NTFS encrypted file: recover at once into an encrypted NTFS file when run on a EFS supporting platform.