- A -
Apple CoreStorage/FileVault/Fusion Drive Volumes
- B -
Bad Sectors settings
Set default read retries count for all drives
BitLocker System Drive Encryption
Broken File Name
Rename and change all invalid symbols to:
Broken File Name options
Button
Buttons
- C -
Connect to R-Studio settings
Connecting Virtual Objects to the System
Contact information and technical support
Contextual menu
Contextual menu
Find Previous Versions of the File
Find Template Signature Previous
Remove All Scanned Information
Contextualt menu
Create menu
Creating and saving your own RAID configuration
Creating Startup Disks for Mac and Linux Computers
- D -
Data Copy in Text/hexadecimal editor
Data Recovery on HFS/HFS+ File System
Description Files for RAID Configuration
Devices to Store Recovered Files
Dialog box
Dialog boxes
Edit Block RAID Layout Presets
Please configure R-Studio Agent for Mac
Please configure R-Studio Agent for Windows
R-Studio Agent for Linux Configuration
There is not enough space on the disk
Drive menu
- E -
Edit menu
Find Template Signature Previous
Editor tabs
Exclusive Region options
- F -
Fast Search for Lost Partitions
File Already Exists
File Information R-Studio Technician/T80+
File mask options
File menu
Load File Names from File and Mark
File Systems settings
Default encoding for Ext2/Ext3/Ext4/UFS volumes
Default encoding for HFS volumes
File Type Signature Specification
File Types
Find options
Find/mark objects only in real paths, ignore links to folders
Find/Mark options
Finding Previous File Versions
Forensic Data Collection Audit Log
- H -
Help menu
Hidden Attribute
High Sierra- Monterey: Running R-Studio for the First Time
- I -
Image Options (Advanced)
Image options (Main)
Compressed image (R-Drive Image compatible)
Image type:
Byte to byte image to a physical disk
Compressed image (R-Drive Image compatible)
VMDK (VmWare Virtual Machine Disk)
- K -
Known File Types settings
- L -
Log options
Maximum messages in the Event Log
- M -
Main settings
Reset all hidden notifications
Messages
Double-click a logical disk...
Mount options
- N -
Nested and Non-Standard RAID Levels
- O -
Opening several disks/partitions in one tab
- P -
Panels
Panes
Properties tab
- Q -
- R -
Recover options
Condense successful restoration events:
Recover alternative data streams:
Recover real folders structure
Region options
Contact information and technical support
Installing R-Studio Agent Emergency Startup Media Creator
Starting a Computer with the R-Studio Agent Emergency Startup Disk
R-Studio Agent for Mac menu
R-Studio Agent for Windows main panel
Contact Informaiton and Technical Support
Installing R-Studio Emergency Startup Media Creator
Properties and Text/Hexadecimal Viewer
Starting a Computer with the R-Studio Emergency Startup Disks
R-Studio Emergency Startup Media Creator
R-Studio menu
- S -
Save only marked files/folders from...
Scan options
Search options
Settings
Startup Media Troubleshooting Options
Symbolic Links
Don't show symbolic links by default (Technician version)
Recovery as it is (Technician version)
Show folder symbolic links as links to their targets, without target content (Technician version)
Symbolic links display settings
Symbolic links recovery options
Syntaxis of a Description File for RAID Configurations
System Options
- T -
Tabs
Technical Information and Troubleshooting
Tools
Tools menu
- U -
- V -
Ventura+: Running R-Studio for the First Time
View menu
Volume Sets, Stripe Sets, and Mirrors
- W -
Window
Working with RAID 6 Presets
Below is an example of a commented pattern parsing an AVI file.
<?xml version="1.0" encoding="utf-8"?>
<!-- A pattern section. The pattern name is AVI File . -->
<template name="AVI File">
<!-- A template signature section. Alignment is 1. -->
<signature align="1">
<!-- A 4-byte signature at offset 0x00. -->
<field offset="0x00">52 49 46 46</field> <!-- ANSI: RIFF -->
<!-- A 4-byte signature at offset 0x08. -->
<field offset="0x08">41 56 49 20</field> <!-- ANSI: LIST -->
</signature>
<!-- A data section. Its name is AVI File . This is the main data section. It is not shown in the parsing tree as a section (its name is ignored). -->
<section name="AVI File">
<!-- The first 4 bytes are read and shown as an ANSI string. -->
<field type="char" size="4" name="Signature: RIFF" var="signature"/>
<!-- The current position is moved to the beginning of the file. -->
<goto offset="-4"/>
<!-- The first 4 bytes in the file are read and shown as an unsigned integer. The internal variable signature gets the value of the field. -->
<field type="uint32" base="hex" name="Signature RIFF as unsigned integer in hex format" var="signature"/>
<!-- A test against the condition ( signature == RIFF ) -->
<if test="signature == 0x46464952"> <!-- ANSI: RIFF -->
<!-- The next 4 bytes are read and shown as an unsigned integer. The internal variable dataSize gets the value of the field. -->
<field type="uint32" name="Size of the data in file" var="dataSize"/>
<!-- A new internal variable endOfFile is created and the expr field evaluates its value.-->
<setvar var="endOfFile" expr="offset + dataSize - 8"/>
<!-- The next 4 bytes is read and shown as an ANSI string. -->
<field type="char" size="4" name="File type"/>
<!-- A new section named DATA is created -->
<section name="DATA">
<!-- A new internal variable chunksOffset is created, the expr filed evaluating its value. This variable gets the absolute value of template offset. -->
<setvar var="chunksOffset" expr="start_position"/>
<!-- A loop is created. Its condition is set in the test field (while the endOfFile variable is greater then the current position.) -->
<repeat test="endOfFile > offset">
<!-- 4 bytes are read and shown as an ANSI string. -->
<field type="char" size="4" name="Signature"/>
<!-- The current position is moved backwards by 4 bytes. -->
<goto offset="-4"/>
<!-- The same 4 bytes are read and shown as an unsigned integer. The internal variable signature gets this value. -->
<field type="uint32" name="Signature as unsigned integer" var="signature"/>
<!-- A test against the condition ( signature == LIST ) -->
<if test="signature == 1414744396"> <!-- ANSI: LIST -->
<!-- The section is shown. Its name is LIST -->
<section name="LIST">
<!-- The current position is moved backward by 4 bytes. -->
<goto offset="-4"/>
<!-- The 4 bytes are read and shown as an unsigned hexadecimal integer. This field has the attributes offset and assigned-template . If the user double-clicks this field, the AVI File LIST pattern will be invoked and the current pattern position will be moved to the address specified in as-offset .-->
<field type="uint32" base="hex" name="Signature LIST as unsigned integer in hex format" as-offset="start_position + offset - 4" assigned-template="AVI File LIST"/>
<!-- The next 4 bytes are read and shown as an unsigned integer. The listSize variable gets its value. -->
<field type="uint32" name="Size of the data in the list" var="listSize"/>
<!-- The 4 bytes are read and shown as an ANSI string. -->
<field type="char" size="4" name="List type"/>
<!-- The current position is moved backward by 4 bytes. -->
<goto offset="-4"/>
<!-- The same 4 bytes are shown as an unsigned hexadecimal integer. The listType variable gets its value.-->
<field type="uint32" base="hex" name="List type as unsigned integer in hex format" var="listType"/>
<!-- A test against condition ( type == movi ) -->
<if test="listType == 0x69766f6d"> <!-- ANSI: movi -->
<!-- The chunksOffset variable gets the value evaluated in the expr attribute. -->
<setvar var="chunksOffset" expr="start_position + offset - 4"/>
</if>
<!-- The current position is moved to the address evaluated in the address attribute. -->
<goto address="offset + listSize - 4"/>
</section>
</if>
<!-- A test against condition ( signature == JUNK ) -->
<if test="signature == 1263424842"> <!-- ANSI: JUNK -->
<!-- The section is shown with the JUNK name. -->
<section name="JUNK">
<!-- The next 4 bytes are read and shown as an unsigned integer. The internal variable junkSize gets its value. -->
<field type="uint32" name="Size of the data of the junk" var="junkSize"/>
<!-- The current position is moved by junkSize bytes forward. -->
<goto offset="junkSize"/>
</section>
</if>
<!-- A test against condition ( signature == idx1 ) -->
<if test="signature == 829973609"> <!-- ANSI: idx1 -->
<!-- The section is shown with the idx1 name. -->
<section name="idx1">
<!-- The next 4 bytes are read and shown as an unsigned integer. The internal variable idxSize gets its value. -->
<field type="uint32" name="Size of the data of the idx1" var="idxSize"/>
<!-- The section is shown with the First AVIINDEXENTRY name. -->
<section name="First AVIINDEXENTRY">
<!-- The 4 bytes are read and shown as an ANSI string. -->
<field type="char" size="4" name="Chunck id"/>
<!-- The next 4 bytes are read and shown as an unsigned hexadecimal integer. -->
<field type="uint32" base="hex" name="Flags"/>
<!-- The next 4 bytes are read ans shown as an unsigned hexadecimal integer. The offset attribute is evaluated for this field as a sum of the chunksOffset variable and valued of this field. -->
<field type="uint32" base="hex" name="Chunk offset" as-offset="chunksOffset + this"/>
<!-- The next 4 bytes are read and shown as an unsigned integer. -->
<field type="uint32" name="Chunk size"/>
</section>
<!-- The current position is moved by idxSiz bytes forward. -->
<goto offset="idxSize"/>
</section>
</if>
<!-- A test against the condition. && is a logical AND ( && ) -->
<if test="signature != 1414744396 && signature != 1263424842 && signature != 829973609">
<!-- An empty section is shown. Its name is Unknown signature found -->
<section name="Unknown signature found">
</section>
<!-- The current position is moved to the address set in the endOfFile variable. -->
<goto address="endOfFile"/>
</if>
</repeat>
</section>
</if>
</section>
</template>