- A -
Apple CoreStorage/FileVault/Fusion Drive Volumes
- B -
Bad Sectors settings
Binary (byte to byte copy)
BitLocker System Drive Encryption
Broken File Name
Rename and change all invalid symbols to:
Broken File Name options
Button
Buttons
Create virtual volume sets or RAIDs
- C -
Connect to R-Studio settings
Contact information and technical support
Find Previous Versions of the File
Find Template Signature Previous
Remove All Scanned Information
Contextt menu
Create menu
Creating and saving your own RAID configuration
Creating Startup Disks for Mac and Linux Computers
- D -
Data Copy in Text/hexadecimal editor
Data Recovery on HFS/HFS+ File System
Description Files for Various RAID Configurations
Devices to Store Recovered Files
Dialog box
Dialog boxes
Edit Block RAID Layout Presets
Please configure R-Studio Agent for Mac
Please configure R-Studio Agent for Windows
R-Studio Agent for Linux Configuration
There is not enough space on the disk
Drive menu
- E -
Edit menu
Find Template Signature Previous
Editor tabs
Exclusive Region options
- F -
Fast Search for Lost Partitions
File Already Exists
File Information (R-Studio Technician/T80+)
File mask options
File menu
File Systems settings
Default encoding for Ext2/Ext3/Ext4/UFS volumes
Default encoding for HFS volumes
File Type Signature Specification
File Types
Find options
Find/Mark options
Find/mark objects only in real paths, ignore links to folders
Finding Previous File Versions
Forensic Data Collection Audit Log
- H -
Hidden Attribute
- I -
Image options
Image type:
Byte to byte image to a physical disk
Compressed image (R-Drive Image compatible)
VMDK (VmWare Virtual Machine Disk)
- K -
Known File Types settings
- L -
Log settings
Maximum messages in the Event Log
- M -
Main settings
Reset all hidden notifications
Messages
Double-click a logical disk...
- N -
Nested and Non-Standard RAID Levels
- O -
Opening several disks/partitions in one tab
- P -
Panels
Panes
Properties tab
- Q -
- R -
Recover options
Condense successful restoration events:
Open local folder (folders) when done
Recover alternative data streams:
Recover real folders structure
Region options
Contact information and technical support
Installing R-Studio Agent Emergency Startup Media Creator
Starting a Computer with the R-Studio Agent Emergency Startup Disk
R-Studio Agent for Mac main panel
R-Studio Agent for Windows main panel
Contact Informaiton and Technical Support
Installing R-Studio Emergency Startup Media Creator
Properties and Text/Hexadecimal Viewer
Starting a Computer with the R-Studio Emergency Startup Disks
R-Studio Emergency Startup Media Creator
- S -
Scan options
Search options
Settings
Shortcut menu
Smart drive copy
Copy all partitions onto original places
Expand/Shrink partition to whole disk
Smart partition copy
Startup Media Troubleshooting Options
Symbolic Links
Automatic recovery without symlink object path conversion
Don't show symbolic links by default (Technician version)
Recovery as it is (Technician version)
Show folder symbolic links as links to their targets, without target content (Technician version)
Show symbolic links as links to their targets, without target content
Symbolic links display settings
Symbolic links recovery options
Syntaxis of a Description File for RAID Configurations
- T -
Tabs
Technical Information and Troubleshooting
Tools menu
- U -
- V -
Various Disk and Volume Managers
View menu
Volume Sets, Stripe Sets, and Mirrors
- W -
Window
Working with RAID 6 Presets
Currently R‑Studio for Linux supports two versions of file type descriptions. Version 2 extends legacy Version 1 by adding variable signature offsets and AND/OR combination of several signatures in one file type. The version of file type description is specified by the version attribute of the FileTypeList section . Version 1 is the default option.
File structure
File header
The file starts with a standard XML header
<?xml version="1.0" encoding="utf-8"?>
Section FileTypeList
<FileTypeList>
version |
1.0 2.0 |
Optiona l |
Version of file type description |
Default: 1.0 |
It requires a closing element </FileTypeList> .
Comments
<!-- Comment string -->
An XML-standard string for a comment.
Version 1 of file type description
<FileTypeList>
<FileType id="2" group="archive" description="ARJ Archive" extension="arj">
<Signature offset="3" count="1">Abc\x5c\x00\x04</Signature>
<Signature offset="9" count="2">\x23\x01\xf4</Signature>
</FileType>
</FileTypeList>
Section FileType
This is a description of each file signature.
id |
<u32> |
Required |
Digital file type identifier. Should be unique for each file type. |
|
group |
<string> |
Optional |
Specifies a file type group in which found files will appear. You may specify either your own groups or those predefined on the File Types dialog box. See the table below. |
Default: unknown |
description |
<string> |
Optional |
Brief file description |
Default: null (no description) |
features |
NO_SCAN TXT_ANSI TXT_UNICODE |
Optional |
Additional properties of the file type. If you want to specify several properties, they should be separated by a space. |
Default: 0 |
extension |
<string> |
Optional |
File extension. |
Default: null (no extension) |
NO_SCAN |
Not to be scanned for. If this flag is used, R‑Studio for Linux will not search for such file type. Such files will be shown when sorting files by their extensions. |
TXT_ANSI |
The file can be viewed as ANSI text. If this flag is specified, the file can be correctly represented as an ANSI text. When previewing, this file will be immediately sent to Text/​hexadecimal editor . |
TXT_UNICODE |
The file can be viewed as UNICODE text. If this flag is specified, the file can be correctly represented as a UNICODE text. When previewing, this file will be immediately sent to Text/​hexadecimal editor . |
Group |
Name on the File Types dialog box. |
archive |
Archive Files |
graphics |
Graphics/Picture |
internet |
Internet-related files |
multimedia |
Multimedia Files |
audio |
Multimedia: Audio Files |
video |
Multimedia: Video Files |
font |
Font |
document |
Document |
doc_database |
Document: Database |
doc_sheet |
Document: Spreadsheet |
exe |
Executable/Library/DLL |
unknown |
Other file types |
This section can contain an unlimited number of the Signature elements.If there are several Signature elements, that means that all those signatures are simultaneously present in the file. Such signatures should have different offset attributes and they should not overlap.
Element Signature
The element contains a string value of the file signature consisting of ASCII characters and hex bytes in the \xhh format, where hh is a hexadecimal byte code. If that is not a hexadecimal number after \x , \x are treated as a part of the string section of the signature
offset |
<u16> |
Optional |
Decimal offset for the signature |
Default: 0 |
count |
<u16> |
Optional |
Decimal number specifying the number of signatures of the same length. Used when several signatures of the same length starting with the same offset can be present in a file. In this case they should be sequentially written in the element, and the size attribute specifies the length of signature. count*size should be equal to the number of bytes in the element. If only one signature can be on this offset, count should be equal to " 1 ", and size should be equal to the length (the number of bytes) of the signature. |
Default: 1 |
size |
<u16> |
Optional |
Decimal number specifying the number of bytes in the signature. |
Default: the number of bytes written in the element. |
from |
begin end |
Optional |
Specifies from where the offset is calculated. If end, the offset is from the end of file to the first byte of the signature. That is, if the signature is two bytes long, the offset value should be 2 . |
Default: begin |
Version 2 of file type description
<?xml version="1.0" encoding="utf-8"?>
<FileTypeList version="2.0">
<FileType id="5626" group="_Test" description="Test file" extension="tst">
<Begin combine="and">
<Signature from="0" to="20">ABC</Signature>
<Signature offset="1">CDEFG</Signature>
<AND>
<Signature offset="0">DE</Signature>
<Signature offset="0">RTD</Signature>
<OR>
<Signature offset="12">CP</Signature>
<Signature offset="16">RTD</Signature>
</OR>
</AND>
</Begin>
<End combine="or">
<Signature from="3" to="20">ABC</Signature>
<Signature offset="5">CDEFG</Signature>
<AND>
<Signature offset="2">DE</Signature>
<Signature offset="3">RTD</Signature>
<OR>
<Signature offset="12">CP</Signature>
<Signature offset="16">RTD</Signature>
</OR>
</AND>
</End>
</FileType>
</FileTypeList>
Section FileType
This is a description of each file signature.
Similar to those in Version 1.
The section can contain one element Begin and one End . It should contain at least one of them.
<FileTypeList version=”2.0”>
<FileType id="2" group="archive" description="ARJ Archive" extension="arj">
<Begin [attributes]>
...
</Begin>
<End [attributes]>
...
</End>
</FileType>
</FileTypeList>
Sections Begin and End
Specify the positions of file type signatures in the file.
combine |
and or |
Optional |
Shows the order of the logical operation (union or intersection) |
Default: and |
These sections can contain one of several elements Signature . And one or several elements OR or AND . If there are several elements inside the section they are combined according to the attribute combine .
<FileTypeList version=”2.0”>
<FileType id="2" group="archive" description="ARJ Archive" extension="arj">
<Begin combine="or">
<Signature [attributes]> ... </Signature>
...
<Signature [attributes]> ... </Signature>
<AND>
...
</AND>
<OR>
...
</OR>
</Begin>
<End>
<OR>
...
</OR>
<Signature [attributes]> ... </Signature>
...
<Signature [attributes]> ... </Signature>
</End>
</FileType>
</FileTypeList>
Sections AND and OR
These sections can contain one of several elements Signature . And one or several elements OR or AND . If there are several elements inside the section they are combined according to the section type (logical AND or OR ).
<FileTypeList version=”2.0”>
<FileType id="2" group="archive" description="ARJ Archive" extension="arj">
<Begin>
<Signature [attributes]> ... </Signature>
...
<Signature [attributes]> ... </Signature>
<AND>
<Signature [attributes]> ... </Signature>
<OR>
<Signature [attributes]> ... </Signature>
<AND>
<Signature [attributes]> ... </Signature>
<Signature [attributes]> ... </Signature>
</AND>
<OR>
<Signature [attributes]> ... </Signature>
<Signature [attributes]> ... </Signature>
</OR>
</OR>
<Signature [attributes]> ... </Signature>
</AND>
</Begin>
</FileType>
</FileTypeList>
Element Signature
The element contains a string value of the file signature consisting of ASCII characters and hex bytes in the \xhh format, where hh is a hexadecimal byte code. If that is not a hexadecimal number after \x , \x are treated as a part of the string section of the signature
offset |
<u16> |
Optional |
Decimal offset for the signature |
Default: 0 |
from |
<u16> |
Optional |
Decimal number specifying the leftmost possible offset for the file signature. Ignored if the offset attribute is specified. |
Default: undefined |
to |
<u16> |
Optional |
Decimal number specifying the rightmost possible offset for the file signature. Ignored if the offset attribute is specified. |
Default: undefined |
size |
<u16> |
Optional |
Decimal number specifying the number of bytes in the signature. |
Default: the number of bytes written in the element. |
<FileTypeList version=”2.0”>
<FileType id="2" group="archive" description="ARJ Archive" extension="arj">
<Begin>
<Signature offset="3">Abc\x5c\x00\x04</Signature>
<Signature from="9" to="15">\x23\x01\xf4</Signature>
</Begin>
</FileType>
</FileTypeList>