TOC · Work · Menu · Tools

### Virtual File System Reconstruction

Use menu Tools · All Found / Virtual File System... to virtually reconstruct directory structure and prepare found and removed files and directories for recovery. You can repeat reconstruction (or use the button More/Less Results) to include more or fewer files in the reconstructed volume depending on your need.

The results of the Full Scan are used (if the scan was performed). In complex cases of data corruption, you may need to try different volume versions found—see the Full Scan section, Partitions.

Quick volume scan (pure FS results)

This option provides results only within the original file system (without additional found file system fragments). For slightly damaged or healthy file systems (for example, when searching for deleted files), this option usually provides sufficient and most accurate results.

#### FAT/exFAT

Rescan current file system

Rescan the entire volume if the results within the current FS format only are needed and Full Scan is not fulfilled.

Default reconstruction

Use the results of the Full Scan.

FAT Tables Options ("Parameters")

FAT tables contain cluster chains to assemble fragmented files and directories. By testing tables the software selects which table to use or not to use both. However you may try different options to achieve better results of the reconstruction and data recovery in the whole or for specific files.

You may choose which table copy to use (FAT1 or FAT2) or not to use both. The option check (do not use bad sectors) may allow avoiding some wrong chains if there is some damage in tables. ExFAT has only one FAT table which cannot be properly tested (values are correctly defined for fragmented file chains only).

#### Non-FAT File Systems

Default Reconstruction, Less (--) or More (++) Results

Use the results of Full Scan. You may decrease and increase the number of results with buttons -- and ++. The color indicator schematically shows the quality and the number of the selected results (the more additional results the worse their quality).

Advanced

Advanced parameters are primarily for specialists to make some corrections for the reconstruction if a file system is significantly damaged.

MFT Numbers (NTFS)

Filter files by MFT numbers for a partial reconstruction (can be useful if there is not enough RAM for the entire reconstruction).

improve INDX merging

Prevent possible wrong merging of directory branches by considering time stamps.

auto INDX processing (NTFS)

Better (but slower) directory structure reconstruction using information from INDX'es on top of omitted MFT info (full INDX processing - force INDX processing).

process FS journal (NTFS)

Include information from the NTFS $LogFile

Include Shifted (NTFS)

Include shifted MFT records (Full Scan must be performed before).

Include Extra Found (NTFS)

Include extra found files into the reconstruction (may contain more garbage but may help if some file is not recoverable other ways).

Include Tech. Records (NTFS)

Include special MFT records into the reconstruction for analysis.

Volume FS Fragments

Manually select FS fragments (found during the Full Scan) to use in the reconstruction. Fragments are grouped by probability of belonging to the open volume:
the best, correct - most likely and likely to belong to the open volume,
related - probably related to other versions of this volume (cf. Full Scan),
unknown - relevant volume is not detected,
extraneous - relevant to a different volume,
small (extra found) - too small for statistics,
disabled - incompatible due to different FS parameters.

##### ReFS

In ReFS v3 any directory node contains a volume id. Other nodes in the FS Fragments list are nodes with an id which is different from the opened volume id.

In a correct FS top nodes contain links for all rest nodes (intermediate and leaf nodes). Upon any change ReFS writes new node versions in a new location and update links so there may be many old directory nodes without references. However for a damaged FS there may be also lost nodes among them. By default old directory nodes are processed as well but a file version control is used to exclude old file refernces (unless the option include all old file entries is turned on).