While scanning the selected area, R‑Studio for Linux reads data directly from the disk, analyzes them, and tries to determine a record to which the data belong. The following record types are possible:

• MBR /GPT records

• NTFS Boot Sector , Folder, and MFT records

• FAT / exFAT Boot Sector , folder, and file records

• ReFS Boot sector records and ReFS Meta blocks

• HFS/HFS+ Volume headers and BTree+ nodes

• APFS Super blocks, APFS Volume blocks, and APFS nodes

• Ext2/3/4FS SuperBlocks records

• UFS/FFS SuperBlock records

• Specific file signatures of Known File types for raw file carving

All these record types have different, but known, structure. Knowing valid values of record fields and relations between them for each record type, R‑Studio for Linux determines a record type for the data. If such record type cannot be unambiguously determined, the data are assigned to the most probable record type. The same data can be assigned to several record types, with a certain probability for each assignment. A list of possible files is generated from these records.

R‑Studio for Linux generates a record list for each record type. This list contains references to records assigned to a record type from the list with their assignment probability. The same data can be included into different record lists. Then R‑Studio for Linux analyzes relations between elements in each list and between different lists, and generates a list of found partitions with their parameters, such as partition start point and probable size, file system type, cluster size, and existence probability.

Using the file list and partition list, R‑Studio for Linux reconstructs file systems and files on the found partitions. One file can be attributed to several different partitions.

When the entire disk or its part has been scanned, R‑Studio for Linux shows all found partitions. Then the parameters of the found partitions may be manually corrected, if additional information on them is available.

Using the IntelligentScan technology, R‑Studio for Linux can recover files not only on new and existing partitions. It also can find and recover data on partitions that have been deleted or reformatted . If, for example, there was an NTFS partition, which later was reformatted as a FAT partition, R‑Studio for Linux will show two partitions on the same place on the disk, one having the FAT file system, the other the NTFS. Then, found files can be recovered.

The IntelligentScan technology makes R‑Studio for Linux a very powerful data recovery tool, but it is not omnipotent. As it uses probabilistic approach to data reconstruction, it cannot guarantee 100% correct results. Moreover, even if R‑Studio for Linux has reconstructed data structure correctly, it is impossible to guarantee that all found files will be completely and correctly recovered, as new data may be already written over the old files. See the Data Recovery Issues topic for details.

Data Recovery Articles

PC Privacy Articles

Home > Technical Information and Troubleshooting > IntelligentScan Technology

IntelligentScan Technology

Home > Technical Information and Troubleshooting > IntelligentScan Technology