- A -
Apple CoreStorage/File Vault/Fusion Drive Volumes
- B -
Bad Sectors settings
Broken File Name
Rename and change all invalid symbols to:
Broken File Name options
Button
Buttons
- C -
Connect to R-Studio settings
Connecting Virtual Objects to the System
Contact information and technical support
Contextual menu
Contextual menu
Find Previous Versions of the File
Find Template Signature Previous
Remove All Scanned Information
Contextualt menu
Create menu
Creating and saving your own RAID configuration
Creating Startup Disks for Mac and Linux Computers
- D -
Data Copy in Text/hexadecimal editor
Data Recovery on HFS/HFS+ File System
Description Files for RAID Configuration
Devices to Store Recovered Files
Dialog box
Dialog boxes
Edit Block RAID Layout Presets
Please configure R-Studio Agent for Mac
Please configure R-Studio Agent for Windows
R-Studio Agent for Linux Configuration
There is not enough space on the disk
Drive menu
- E -
Edit menu
Find Template Signature Previous
Editor tabs
Exclusive Region options
- F -
Fast Search for Lost Partitions
File Already Exists
File Information R-Studio Technician/T80+
File mask options
File menu
Load File Names from File and Mark
File Systems settings
Default encoding for Ext2/Ext3/Ext4/UFS volumes
Default encoding for HFS volumes
File Type Signature Specification
File Types
Find options
Find/mark objects only in real paths, ignore links to folders
Find/Mark options
Finding Previous File Versions
Forensic Data Collection Audit Log
- H -
Help menu
Hidden Attribute
- I -
Image Options (Advanced)
Image options (Main)
Compressed image (R-Drive Image compatible)
- K -
Known File Types settings
- L -
Log options
Maximum messages in the Event Log
- M -
Main settings
Messages
Double-click a logical disk...
Mount options
- N -
Nested and Non-Standard RAID Levels
- O -
Opening several disks/partitions in one tab
- P -
Panels
Panes
Properties tab
- Q -
- R -
Recover options
Condense successful restoration events:
Recover alternative data streams:
Recover real folders structure
Region options
Contact information and technical support
Installing R-Studio Agent Emergency Startup Media Creator
Starting a Computer with the R-Studio Agent Emergency Startup Disk
R-Studio Agent for Mac menu
R-Studio Agent for Windows main panel
Contact Informaiton and Technical Support
Installing R-Studio Emergency Startup Media Creator
Properties and Text/Hexadecimal Viewer
Starting a Computer with the R-Studio Emergency Startup Disks
R-Studio Emergency Startup Media Creator
R-Studio menu
- S -
Save only marked files/folders from...
Scan options
Search options
Settings
Startup Media Troubleshooting Options
Symbolic Links
Automatic recovery without symlink object path conversion
Syntaxis of a Description File for RAID Configurations
System Options
- T -
Tabs
Technical Information and Troubleshooting
Tools
Tools menu
- U -
- V -
View menu
Volume Sets, Stripe Sets, and Mirrors
- W -
Window
Working with RAID 6 Presets
Note : This feature is available for the Technician version of R-Studio only!
When this mode is enabled, R-Studio will generate a forensic data collection audit log that can be presented at court hearings. This log includes information about a hardware configuration on which the forensic data collection takes place and MD5 for recovered files.
Note: A new log will be generated each time the hardware configuration is changed (a hard drive is connected/disconnected, an external USB device is connected/disconnected, etc)
To enable this feature,
Each time you start file recovery, the Forensic Log Settings dialog box will appear.
Enter the required information and click the OK button to go to the Recovery dialog box.
While file recovery, R-Studio will create forensic data collection audit log in the specified folder. Below is an example of such log.
******************************** Forensic Data Collection Audit Log ********************************
R-STUDIO network edition Build 1004/Mar 10 2010
Case Name: Steven v Christofor
Case Number: 28-5-0205-CR-85763
Operator / Investigator Name: J.F. Lewson
**************************************** Drives Information ****************************************
- Drive Number 0 ---------------------------------
* Drive Type [256 bytes]: Computer,Local Computer
* Name [30 bytes]: Local Computer
* OS [32 bytes]: Mac OS X 10.4.5
* System [10 bytes]: i386
- Drive Number 1 ---------------------------------
* Drive Type [256 bytes]: Physical Drive,Disk
* Name [34 bytes]: ST3120811AS3.AAE
* OS Object [22 bytes]: /dev/disk0
* Size [8 bytes]: 111 Gb (234441648 sec)
* Sector Size [4 bytes]: 512 b
# I/O Tries [4 bytes]: Default
+ Drive Control [4 bytes]:
# Maximum Transfer [4 bytes]: 32768
# I/O Unit [4 bytes]: 512
# Buffer Alignment [4 bytes]: 4096
+ Device Identification [4 bytes]:
* Product [64 bytes]: ST3120811AS
* Firmware [16 bytes]: 3.AAE
* Serial Number [32 bytes]: 6PT0J1FH
* Bus Type [4 bytes]: SerialATA
+ IDE Properties [4 bytes]:
* Buffer [10 bytes]: 8 MB
* ECC Bytes [2 bytes]: 4
* PIO Modes [16 bytes]: 1,2,3,4
* DMA Modes [12 bytes]: 0,1,2
* UltraDMA Modes [28 bytes]: 0,1,2,3,4,5,6
* Current Mode [22 bytes]: UltraDMA 5
- Drive Number 2 ---------------------------------
* Drive Type [256 bytes]: Partition,Primary
* Name [22 bytes]: Partition1
* Size [8 bytes]: 29996 Mb (61432497 sec)
* Partition Offset [8 bytes]: 32256 b (63 sec)
* Partition Size [8 bytes]: 29996 Mb (61432497 sec)
* Partition Type [256 bytes]: NTFS/HPFS
+ NTFS Information [4 bytes]:
* Cluster Size [4 bytes]: 4096 b (8 sec)
* MFT Record Size [4 bytes]: 1024 b
* MFT Position [8 bytes]: 3072 Mb (6291456 sec)
* MFT Mirror Position [8 bytes]: 14998 Mb (30716248 sec)
* Index Block Size [4 bytes]: 4096 b
* Sector Size [4 bytes]: 512 b
* Volume Size [8 bytes]: 29996 Mb (61432496 sec)
- Drive Number 3 ---------------------------------
* Drive Type [256 bytes]: Partition,Active
* Name [22 bytes]: Partition2
* Size [8 bytes]: 29996 Mb (61432560 sec)
* Partition Offset [8 bytes]: 29996 Mb (61432560 sec)
* Partition Size [8 bytes]: 29996 Mb (61432560 sec)
* Partition Type [256 bytes]: Mac OS X HFS+
+ HFS/HFS+ Information [4 bytes]:
* HFS Type [62 bytes]: HFS+, Journaled, Not unmounted
* Block Size [4 bytes]: 4096 b (8 sec)
* HFS Version [4 bytes]: 4
* Create Time [8 bytes]: 1.5.2007 19:16:12
* Last Write Time [8 bytes]: 10.3.2010 17:10:55
* Last Check Time [8 bytes]: 2.5.2007 2:16:12
* Volume Size [8 bytes]: 29996 Mb (61432560 sec)
- Drive Number 4 ---------------------------------
* Drive Type [256 bytes]: Partition,Primary
* Name [22 bytes]: Partition3
* Size [8 bytes]: 24003 Mb (49158900 sec)
* Partition Offset [8 bytes]: 58 Gb (122865120 sec)
* Partition Size [8 bytes]: 24003 Mb (49158900 sec)
* Partition Type [256 bytes]: Ext2FS/XIAFS
+ Ext2/Ext3/Ext4 Information [4 bytes]:
# FS Character Set [4 bytes]: OEM
* Block Size [4 bytes]: 4096 b (8 sec)
* First SuperBlock Offset [4 bytes]: 1024 b (2 sec)
* Blocks Per Volume [4 bytes]: 6144862
* INodes Per Volume [4 bytes]: 3074176
* Creator OS [4 bytes]: Linux
* Major Version [4 bytes]: 1
* Minor Version [2 bytes]: 0
* Last Mount Time [8 bytes]: 2.3.2010 15:38:42
* Last Write Time [8 bytes]: 2.3.2010 16:54:45
* Last Check Time [8 bytes]: 22.1.2010 15:32:55
* Volume Size [8 bytes]: 24003 Mb (49158896 sec)
- Drive Number 5 ---------------------------------
* Drive Type [256 bytes]: Partition,Logical
* Name [22 bytes]: Partition4
* Size [8 bytes]: 1953 Mb (4000122 sec)
* Partition Offset [8 bytes]: 82 Gb (172024083 sec)
* Partition Size [8 bytes]: 1953 Mb (4000122 sec)
* Partition Type [256 bytes]: Linux (swap)
- Drive Number 6 ---------------------------------
* Drive Type [256 bytes]: Partition,Logical
* Name [22 bytes]: Partition5
* Size [8 bytes]: 28521 Mb (58412277 sec)
* Partition Offset [8 bytes]: 83 Gb (176024268 sec)
* Partition Size [8 bytes]: 28521 Mb (58412277 sec)
* Partition Type [256 bytes]: FAT32
+ FAT Information [4 bytes]:
* FAT Bits (12,16,32) [4 bytes]: 32
* Cluster Size [4 bytes]: 16384 b (32 sec)
* First Cluster Offset [8 bytes]: 14240 Kb (28480 sec)
* Root Directory Cluster [4 bytes]: 2
* First FAT Offset [8 bytes]: 18432 b (36 sec)
* Size of One FAT Table [8 bytes]: 7127 Kb (14254 sec)
* Number of FAT Copies [4 bytes]: 2
# Active FAT copy [4 bytes]: Auto
* Sector Size [4 bytes]: 512 b
* Major Version [1 bytes]: 0
* Minor Version [1 bytes]: 0
* Volume Size [8 bytes]: 28521 Mb (58412277 sec)
****************************************************************************************************
-------------------------------------------- Session 2 ---------------------------------------------
START Date / Time of Collection: 2010-03-10 20:38:40
Source drive:Sector Modification Date MD5 File Name
6: 6333056 2008-02-15 01:07:42 Video
6: 6333120 2008-01-19 05:47:48 1778568d4a8f7e372e159494a95ed542 Video/1-1.avi
6: 19130048 2009-04-30 03:47:24 710481dff181558bfc9b1bb222d47c56 Video/IMG_7624.jpg
6: 23097376 2009-12-09 22:15:42 Recovered_Files
6: 25473216 2009-12-25 21:07:28 Recovered_Files/Root
6: 4491200 2010-02-03 00:11:08 Recovered_Files/Root
6: 37777280 2010-02-03 23:45:04 Recovered_Files/Root
6: 39615936 2010-02-04 00:17:24 Recovered_Files/Root
6: 4931616 2010-02-19 20:35:48 Recovered_Files/Root
6: 4950240 2010-02-19 20:38:34 Recovered_Files/Root
6: 4950304 2010-02-19 20:39:24 Recovered_Files/Root
6: 4950368 2010-02-19 20:41:00 Recovered_Files/Root
6: 4950432 2010-02-19 20:42:54 Recovered_Files/Root
6: 4975136 2010-02-20 19:18:54 Recovered_Files/Root
6: 4975296 2010-02-20 19:45:24 Recovered_Files/Root
END Date / Time of Collection: 2010-03-10 20:39:50
----------------------------------------------------------------------------------------------------