TOC · Work · Menu · Tools

Full Scan

Comprehensive search method allows you to find and virtually rebuild the directory structure of a damaged file system or to find lost files of known types by signatures if a file system can not be used.

If a file system is not seriously damaged then volumes may be opened before the scan completes. In the most complex cases different volume variants may be given. You should select and Open volume, reconstruct file system and recover files to estimate the quality of a variant. If the selected volume variant does not contain necessary files or files are recovered incorrectly you should continue the search or try another variant. There are indicators which allow preliminary estimating the quality of a variant (details are below). If data was moved (due to partition move/split/merge/resize operation) then some files may be recovered correctly from one volume variant, and others from another one, despite that files are visible on both volume variants.

It is recommended to scan selected area of a physical device (including old and new location of the volume if it was moved) rather than scanning a logical disk. The software may read beyond the selected area if it is necessary.

Open volumeOpen volume selected in the list.
Save...Save search log to a file.
Load...Load search log from a file (to continue previous search or to use previous search results).
Start/StopStart/stop scan. If scan parameters are not changed the scan will be continued.
Parameters Select scan area, FS, parameters to gather data and calculate volumes.
Jumping scan is used when it is necessary to faster find the main results over the entire disk without waiting the scan completes.

Jumping scan is carried out selectively over the entire disk gradually covering the entire scan area. Volumes with the large number of files are being found first.

MenuBesides, allows changing volume sorting order.

NTFS, exFAT, ext2/3/4

The columns % and Check allow estimating data recovery quality of a found volume variant (the percentage and number of successful reference matchings).

Min. Size is the minimum size containing all files in the best volume FS blocks.

FAT

The column Indicators shows the absence (damage) ("-") or presence ("+") of the corresponding FS structures (B - boot sector/copy, F - FAT table/copy, R - root directory).

The column Check shows the number of found directories corresponding to the volume variant.

Raw File Search

File signatures are used to find lost files when recovery by file systems (above) is not possible. Additionally file signatures are used to improve and control the quality for NTFS and exFAT search. Normally there are no reasons to open RAW results individually when FS volumes above are found. RAW results are available under the directory $RAW in the file panel when volume is opened.

RAW recovery is possible only for files which have special signatures. RAW recovery does not work properly for fragmented files (only the first file fragment is recovered correctly). RAW recovery does not provide original file names and directory structure. RAW recovery does not always allow detecting original file sizes. If there is neither end file signature nor built-in size info for a given file type then file recovery continues until the next found file, so searching for all present file types may improve size detection.

Raw: File Signatures: select file types for search, add new known file signatures.

File Signatures

File Signature is a fixed sequence of bytes at the beginning of files of the same type. E.g. if you open a PDF file in a hex editor you can see the first 4 bytes are the same for all pdf files: 25 50 44 46 2D 31 2E 33  0A ... %PDF-1.3... In DMDE you may then specify custom file signature as %PDF or as \x25\x50\x44\x46 (non-ANSI characters must be specified as hex codes \x..). Question mark (?) designates any byte (if it may vary in the signature), \m.. designates a bit mask for the previous byte (unset bits may vary, e.g. \x34\m3F is a 1-byte signature where 6-7th bits may vary).

If the signature position in a file is not fixed then minimum and maximum offsets must be specified. Entire signature must fit in the first 4096 bytes.

Not all file types have special signatures and may be found using RAW search.

Multiple comma separated Extensions may be specified for FS calculation.
Mark signature as reliable if it contains at least 4 different bytes at a fixed position (do not mark otherwise not to truncate other files if false positives happen).
File-container may contain other file types inside (mark in order not to truncate when other type files are met).
EOF Signature is an optional signature at the end of a file.