TOC · Work · Menu · Tools

Data Recovery

Attention! Make sure the device is not damaged beforehand (if device is damaged).

Attention! Do not write anything to the source disk/partition. Recover data to another disk only. It is highly recommended to recover data to another physical device. You may recover to another partition of the same device only if you are sure that the source and destination partitions don't overlap and the device has no physical problems. Do not load system or run software from the partition where lost data is located.

Attention! If files are recovered incorrectly or there are other problems make sure you are using the most recent software versions from a trusted source.

Before data recovery you should find and open volume. To recover all found files (including lost and removed) you should open virtual directory [All Found + Reconstruction]. If you cannot open/play files after recovery you should try different found volumes - return to the results of the Full Scan or to Partitions and open the next volume.

Free Edition supports recovery of up to 4000 files from the current panel only.

Dialog Box "Recover"

Button "Size"

Calculate the size of the data to recover. Global indicator of recovery process is working if the size is calculated. You should not calculate the size to avoid unnecessary device load on devices with bad sectors.

Button "List"

Save list of files selected for recovery to a file.

"Deleted", "Found", files "by signatures"

Recover corresponding file categories - see File Panel.

Checkbox "Include NTFS altstreams" (Professional Edition only)

Recover NTFS alternate data streams (Alt. stream name and file name are separated by a colon, i.e. FileName:StreamName).

Create report (Professional Edition only)

Save recovery report to a file. List files and directories, log file I/O errors, calculate checksums CRC32, MD5, SHA1.

File filter

Define name masks (semicolon separated) to recover matching files only. Wildcards "*" and "?" may be used. Exclusion masks may be also defined by prepending a backslash "\". Masks at the beginning have a priority. E.g. the name abc.tmp matches a*;\*.tmp and does not match \*.tmp;a*.

File size limits

Filter files by size. Use 0 (zero) as a second value if you wish to set a lower limit only.

Additional Issues

Checkbox "Unicode names"

The option is set if there is Unicode support in OS, otherwise symbols outside the selected code page must be transliterated or substituted (see Locales). Unavailable in DOS.

Recover to a FAT formatted volume, checkbox "Split large files"

FAT volumes do not support files greater than 4GB (or sometimes 2GB). Larger files may be split during recovery upon a request if OS properly reports (which is not always the case) or if the option Split large files is used (preferable). Later you may merge file parts on another disk by using the system utility copy /b part1 + part2 + part3 result, for example. Pure DOS supports only FAT volumes.

File names in DOS, checkbox "Substitute names"

Without special drivers long files names are not supported under DOS. Option Substitute names allows name substitution during recovery. File LRENAME.BAT is being created in the destination folder for backward renaming. To restore original file names load OS Windows, go to the destination folder and execute the file LRENAME.BAT. An appropriate OEM code page must be selected when working in DOS in order to restore national symbols correctly. Unicode symbols outside the selected code page will be transliterated or substituted.

You may add the parameter substnamesutf8=1 or use the option utf-8 to create LRENAME.BAT in the utf-8 format fully supporting Unicode regardless the selected code page. Utf-8 format is supported in Windows 7 and higher.

Paths longer than 259 symbols under Windows NT+

In order to recover paths which are longer than 259 symbols you should manually prepend the destination directory name with a prefix \\?\, e.g.: \\?\D:\. Such long paths may be inaccessible using standard means such as Explorer ("My Computer").

Name Duplicate Handling

During recovery there may be name duplicates if there different versions of the same file/directory are found, if the destination file system doesn't distinguish between some names whilst the source FS distinguishes, if there are already files on the destination path before recovery.

If the OS reports the file/directory exists already you are prompted to choose how to handle the duplicate. You may rename/skip the object manually or choose the "auto rename" or "skip all" options to automatically handle all subsequent objects too. It is also possible to merge directories with duplicated names.

Additionally you are asked for a threshold (maximum duplicates for the same name). When the threshold is exceeded you are asked again for a desired action. Parameters maxfilerenames= and maxdirrenames= are used as default threshold numbers.

The destination file system designates duplicates. Duplicates are not handled if name substitution is used under DOS.

Event Handler... preset recovery events handling (the coincidence of names, I/O errors, and others).

NTFS Encrypted Recovery

NTFS encrypted files are recovered without decryption. You need the certificate from the source OS or backup to be installed on a destination OS to open encrypted files after recovery. Please refer to Microsoft documentation on exporting and importing certificates.

Encryption (EFS) is NTFS (+OS) feature, an encrypted file contains the encrypted data and encryption key which in its turn is encrypted with a certificate key. Since the feature may be unsupported in OS or for destination FS there are recovery options to workaround this.

Recover to separate streams: recover data streams and keys into separate files (.efs and .efk extensions are assigned). Further processing of these files is a user task.
Recover to backup (portable format): recover data and key into a single backup file (.efb). The backup file may be stored on any FS, no OS support is required also. The backup file may later be restored into EFS encrypted file using the menu Tools - Restore NTFS encrypted from backup... (then both OS and FS must support EFS there).
Recover to NTFS encrypted file: recover at once into an encrypted NTFS file. EFS support from both destination file system and operating system is necessary (i.e. NTFS, Windows).