R‑Studio writes directly to a drive only when writing recovered data and from its hex editor, if writing is enabled. In all other actions, R‑Studio only reads data and analyzes them, and never modifies data on the drives being analyzed.

Most operating systems use lazy-write. So, there is a time lag between file actions and actual changes on data on a drive. R‑Studio analyzes data on drives only. That is why it does not always detect recent changes in data structure.

Most operating systems constantly write their service information on drives. Such writing is especially intensive during startup and shutdown procedures. When an operating system deletes a file/folder, it treats the space where it has resided as empty and may write something in this place. If this happened, the file/folder and its parameters may be detected correctly, but its data may be lost.

Folder names like $$$Folder58448 on NTFS partitions mean that the folder has not been found on the drive but some references to it have been. For example, folders My documents , Work , Photos have been found and all they have one parent folder, whose description has not actually been found on the drive, so its name is unknown and therefore represented as $$$Folder58448 . It may happen that the description of such folders was outside of the scan area, so try to enlarge the region or scan the entire drive. If that does not help, most likely that the description of the folder has been overwritten.

Folder names like $ROOT58448 on FAT partitions mean that some folders have been found, but they cannot be included into the folder structure for this FAT partition. Sometimes, such folders may contain other folder structures.

If you recover a file, and it appears that the file contains wrong data, try to do the following:

• Scan :

the logical disk , if the file has been just deleted.

the drive, if the data structure is damaged more seriously .

• Search for the file to be restored on all found partitions and try to recover it from all found partitions. Check each recovered file to ensure that it contains correct data. As soon as you found the partition from which the file is recovered correctly, use this partitions to recover all other deleted files.

If there are several deleted files to be restored, you should use a file larger than 2KB to select the required partition.

FAT file system:

Cross-Linked Folders

Often R‑Studio finds several FAT folder records that contain the same data. Such folders are called cross-linked . R‑Studio marks such folders with an arrow mark:

R‑Studio attributes the content of cross-linked folders to one folder called a target folder . When recovering, R‑Studio places the content to the target folder.

To view the list of cross-linked folders,

1	Right-click a cross-linked folder and select Cross Linked Folders on the shortcut menu

>	A list of cross-linked folders will appear

You may go to any folder in this list by clicking it.

To find a target folder,

*	Right-click a cross-linked folder and select Go Target on the shortcut menu, or

Select the cross-linked folder and select Goto Target on the File menu

If Go Target is gray, this folder is already the target folder.

To set the target folder manually,

*	Right-click a cross-linked folder and select Set As Default Target on the shortcut menu , or

Select the cross-linked folder and select Set As Default Target on the File menu.

If Set As Default Target is gray, this folder is already the target folder.

Questionable Folders

Sometimes, R‑Studio may find FAT records, which look like folders, but their content is invalid. For example, file names have invalid characters, date, time, and size, or other file attributes may look strange. Please note that R‑Studio correctly recognizes localized names. R‑Studio treats such records as folders, but does not analyze their content and structure. You can manually scan such folders, but results may be unpredictable. Usually, such scan reveals garbage.

R‑Studio marks such folders with a question mark.

To re-scan an object,

*	Right-click a questionable folder in the R‑Studio 's Folders panel and select Rescan on the shortcut menu , or

Select the questionable folder and select Rescan on the File menu.

ReFS, NTFS, APFS, HFS, XFS , and ext fs file systems:

Symbolic links (symlinks)

Symbolic links (of symlinks for short) are object that contains references to other files or folders directory in the form of absolute or relative paths and that affect pathname resolution. For example, if a symlink C:\ProgramData\Documents points to D:\Recovered Files\Root\Users\Public\Documents , entering it will result in entering D:\Recovered Files\Root\Users\Public\Documents .

They are present in almost all modern file systems. NTFS, HFS+, APFS, and EXT FS are probably the most popular examples.

R‑Studio shows such symlinks and their targets in the following way:

Symbolic links

Symlinks can be marked for recovery

Marked symbolic links

Only symlinks on the picture above are marked for recovery. They will be recovered as real files and folders.

Marked targets (real folders)

Only targets (real folders) on the picture above are marked for recovery. They will be recovered as real files and folders.

Marked targets (real folders) and symlinks

Both targets (real folders) and symlinks on the picture above are marked for recovery. They will be recovered as real files and folders and symlinks.

The R-Studio Settings topic gives more details about symlink recovery.

Files:

Hard links

Hard links are file system entries that give file names to files. This term is usually used when files may have several names. R‑Studio shows hard links using the following icons:

A hard link:

The target file:

You may find a target or hard link for a file. Right-click the file and select Links on the shortcut menu.

Data Recovery Articles

PC Privacy Articles

Home > Technical Information and Troubleshooting > Data Recovery Issues

Data Recovery Issues

Home > Technical Information and Troubleshooting > Data Recovery Issues