Home

It is common for a disk to be formatted, but as long as it is not a full format (erasing all sectors), most data can still be recovered.  This wizard function works through the stages required for recovery.

The stages of anaysis and recovery are as follows

• Determine if current file system is as expected, if if the drive is currently FAT, was the original disk FAT
• If it is unknown, or a different file system is expected an analysis of the drive is carried out
• The analysis will scan the drive for old partitions, but in particulare will look for MFTs, old FAT directories and old MAC catalog entries
• The end result will be the partition screen shown below and it is clear that a current FAT has in the past been a NTFS drive

• The next stage is to recover data in the format determined from the above.
• As the disk is no longer the selected logical format, it will be necessary to do more analysis on the drive to determine the correct parameters.
• There is an option to Skip program files.  This will skip files such as .dll, .exe, .cab, .ini, .sys.  Generally these types of files do not conatin user data and are not required.

Program features

The program is designed to assist with formatted disks, and ones that the operating system has been reloaded.  In thes cases the directory structure is often lost and recovery results in many 'lost_dir' directories.  Also many files found are not actually required so a filter is set to remove many files that are not normally required on this type of recovery.  The list includes

.dll, .exe, .msi, .cur, .fon, .xml and others

It also skips files found in typical system and program directories, such as

windows, program files, program files (x86)

The intention of the above filtering is to try and just find useful file

As an extra feature for Forensic users, it is possible to select (at the stage where the file system options are show) an extra filter function of removing systems files based on their MD5 hash value.  Hash tables can be downloaded from NSRL and used to skip all known system files