While scanning the selected area, R‑Studio reads data directly from the drive, analyzes them, and tries to determine a record to which the data belong. The following record types are possible:

• MBR /GPT records

• NTFS Boot Sector , Folder, and MFT records

• FAT / exFAT Boot Sector , folder, and file records

• ReFS Boot sector records and ReFS Meta blocks

• HFS/HFS+ Volume headers and BTree+ nodes

• APFS Super blocks, APFS Volume blocks, and APFS nodes

• Ext2/3/4FS SuperBlocks records

• UFS /FFS SuperBlock records

• Specific file signatures of Known File types for raw file carving

All these record types have different, but known, structure. Knowing valid values of record fields and relations between them for each record type, R‑Studio determines a record type for the data. If such record type cannot be unambiguously determined, the data are assigned to the most probable record type. The same data can be assigned to several record types, with a certain probability for each assignment. A list of possible files is generated from these records.

R‑Studio generates a record list for each record type. This list contains references to records assigned to a record type from the list with their assignment probability. The same data can be included into different record lists. Then R‑Studio analyzes relations between elements in each list and between different lists, and generates a list of found partitions with their parameters, such as partition start point and probable size, file system type, cluster size, and existence probability.

Using the file list and partition list, R‑Studio reconstructs file systems and files on the found partitions. One file can be attributed to several different partitions.

When the entire drive or its part has been scanned, R‑Studio shows all found partitions. Then the parameters of the found partitions may be manually corrected, if additional information on them is available.

Using the IntelligentScan technology, R‑Studio can recover files not only on new and existing partitions. It also can find and recover data on partitions that have been deleted or reformatted . If, for example, there was an NTFS partition, which later was reformatted as a FAT partition, R‑Studio will show two partitions on the same place on the drive, one having the FAT file system, the other the NTFS. Then, files found on those partitions can be recovered.

The IntelligentScan technology makes R‑Studio a very powerful data recovery tool, but it is not omnipotent. As it uses probabilistic approach to data reconstruction, it cannot guarantee 100% correct results. Moreover, even if R‑Studio has reconstructed data structure correctly, it is impossible to guarantee that all found files will be completely and correctly recovered, as new data may be already written over the old files. See the Data Recovery Issues topic for details.

Data Recovery Articles

PC Privacy Articles

Home > Technical Information and Troubleshooting > IntelligentScan Technology

IntelligentScan Technology

Home > Technical Information and Troubleshooting > IntelligentScan Technology