Data Recovery Issues

Top  Previous  Next

NEVER TRY TO SAVE RECOVERED FILES/FOLDERS TO THE SAME LOGICAL DISK WHERE THEY RESIDE!!!

Or you may obtain unpredictable results and lose all of your data.

R-Studio writes directly to a hard drive only when writing recovered data and from its hex editor, if writing is enabled. In all other actions, R-Studio only reads data and analyzes them, and never modifies data on the hard drives being analyzed.

Most operating systems use lazy-write. So, there is a time lag between file actions and actual changes on data on a hard drive. R-Studio analyzes data on hard drives only. That is why it does not always detect recent changes in data structure.

Most operating systems constantly write their service information on hard drives. Such writing is especially intensive during startup and shutdown procedures. When an operating system deletes a file/folder, it treats the space where it has resided as empty and may write something in this place. If this happened, the file/folder and its parameters may be detected correctly, but its data may be lost.

Folder names like $$$Folder58448 on NTFS partitions mean that the folder has not been found on the drive but some references to it have been. For example, folders My documents, Work, Photos have been found and all they have one parent folder, whose description has not actually been found on the disk, so its name is unknown and therefore represented as $$$Folder58448. It may happen that the description of such folders was outside of the scan area, so try to enlarge the region or scan the entire hard drive. If that does not help, most likely that the description of the folder has been overwritten.

Folder names like $ROOT58448 on FAT partitions mean that some folders have been found, but they cannot be included into the folder structure for this FAT partition. Sometimes, such folders may contain other folder structures.

If you recover a file, and it appears that the file contains wrong data, try to do the following:

Scan:

the logical disk, if the file has been just deleted.

the hard drive, if the data structure is damaged more seriously.

Search for the file to be restored on all found partitions and try to recover it from all found partitions. Check each recovered file to ensure that it contains correct data. As soon as you found the partition from which the file is recovered correctly, use this partitions to recover all other deleted files.

If there are several deleted files to be restored, you should use a file larger than 2KB to select the required partition.

FAT file system:

Cross-Linked Folders

Often R-Studio finds several FAT folder records that contain the same data. Such folders are called cross-linked. R-Studio marks such folders with an arrow mark:

R-Studio attributes the content of cross-linked folders to one folder called a target folder. When recovering, R-Studio places the content to the target folder.

To view the list of cross-linked folders,

1Right-click a cross-linked folder and select Cross Linked Folders on the shortcut menu
>A list of cross-linked folders will appear

You may go to any folder in this list by clicking it.

To find a target folder,

*Right-click a cross-linked folder and select Go Target on the shortcut menu, or

Select the cross-linked folder and select Goto Target on the File menu

If Go Target is gray, this folder is already the target folder.

To set the target folder manually,

*Right-click a cross-linked folder and select Set As Default Target on the shortcut menu, or

Select the cross-linked folder and select Set As Default Target on the File menu.

If Set As Default Target is gray, this folder is already the target folder.

Questionable Folders

Sometimes, R-Studio may find FAT records, which look like folders, but their content is invalid. For example, file names have invalid characters, date, time, and size, or other file attributes may look strange. Please note that R-Studio correctly recognizes localized names. R-Studio treats such records as folders, but does not analyze their content and structure. You can manually scan such folders, but results may be unpredictable. Usually, such scan reveals garbage.

R-Studio marks such folders with a question mark.

To re-scan an object,

*Right-click a questionable folder on the R-Studio's Folders panel and select Rescan on the shortcut menu, or

Select the questionable folder and select Rescan on the File menu.

NTFS file system:

Symbolic links (symlinks)

Symbolic links (of symlinks) are file system objects that point to other file system objects (named targets). Those objects are usually folders, but may be of any kind. R-Studio shows symlinks and targets using the following icons:

A symlinked folder:

The target folder:

You may find a target or symlink for an object. Right-click the object and select Links on the shortcut menu.

 

Files:

Hard links

Hard links are file system entries that give file names to files. This term is usually used when files may have several names. R-Studio shows hard links using the following icons:

A hard link:

The target file:

You may find a target or hard link for a file. Right-click the file and select Links on the shortcut menu.