We are committed to providing fast, efficient, and affordable software solutions that set new standards in the software development industry.
  • Data Recovery from Various File Container Formats and Encrypted Disks

R-Studio is designed to recover data from physical hard drives and other media. But it can also be used to recover files that have been stored in virtual disks or file container formats. File containers often include all the same parts of a real disk-including a boot record, disk partitions, file systems and individual files and folders. File containers can be uncompressed, compressed or encrypted. In addition, there are utilities that can encrypt an entire disk.

The method for recovering data from a file container depends on its format. This article covers data recovery methods using R-Studio for the most common file container formats.

Types of File Containers with Disk Images

There are several types of file container formats that function as disk images:

  • Uncompressed disk images - This is a sector-by-sector copy of a disk created from a logical volume or an entire physical drive. This type of disk image can be loaded into R-Studio and processed like any other image.
  • Proprietary file containers - Some utilities use their own disk image formats. Proprietary disk images are usually compressed or encrypted. For example, R-Drive Image, a disk imaging, backup and copying utility developed by R-TT, Inc., creates file containers with the .rdr file extension.
  • Encrypted file containers - These are similar to proprietary file containers, but the contents are also encrypted. Only the software used to create the image can mount and read it. If the encrypted container can be mounted in the native software, it can be detected by R-Studio and processed as a normal logical disk.
  • File containers from virtual machines - These are file container formats that are meant to be mounted by a virtual machine, such as a VirtualBox or VMware. These can be loaded in R-Studio as uncompressed images and scanned for partitions.

Uncompressed Disk Images and R-Drive Image File Containers

Uncompressed disk images can be loaded directly into R-Studio. Likewise, R-Drive Image files are natively supported by R-Studio and can be loaded directly and processed like any other image or disk. See the R-Studio's help: Image
File containers with disk images in R-Studio
Fig. 1: File containers with disk images in R-Studio
Click image to enlarge

Proprietary File Container Formats

R-Studio can also process certain proprietary disk images, even if they are not natively supported by R-Studio. This can be done by mounting the file container as a virtual disk using the proprietary software. The contents of the file container will appear in the R-Studio Drives pane as a logical disk and can be processed as such.
A file container mounted as a virtual disk by a proprietary disk imaging program
Fig. 2: A file container mounted as a virtual disk by a proprietary disk imaging program
Click image to enlarge

Note that if a proprietary file container is corrupted to the point that it cannot be connected using its native software, R-Studio can still load it as an uncompressed image and attempt to process it. However, in these cases, chances are small that useful data can be found, especially if the image is compressed.

Encrypted File Container Formats

Some proprietary file container formats are encrypted. This means that the data is unreadable unless it is mounted by its native software (usually using a decryption key). Disk encryption can be applied to a partition, disk image or an entire physical drive (see below . Examples of such programs are the freeware TrueCrypt/VeraCrypt from IDRIX and the free-for-home-use R-Crypto from R-TT, Inc.

Those programs connect their file-containers as virtual logical disks and provide background data encryption/decryption. Such virtual disks appear in the R-Studio Drives pane as logical disks and can be processed as such.
File containers connected to computer as virtual disks by VeraCrypt and R-Crypto
Fig. 3: File containers connected to computer as virtual disks by VeraCrypt and R-Crypto
Click image to enlarge

Unlike compressed proprietary file format containers, if an encrypted disk is corrupted to the point where it cannot be mounted by its native software, then it is nearly impossible to recover data from it. This is because the background encryption/decryption cannot be performed-although R-Studio can perform a sector-by-sector scan of the image, the data won't be recognizable.

File Containers from Virtual Machines

The ideal method for recovering files from a virtual machines is described in the article Data Recovery from Virtual Machines. If this can't be performed, use the method below.

Data recovery from a VHD file used in Microsoft Virtual PC is described in the article Data Recovery from Virtual Hard Disk (VHD) Files. If this can't be performed, use the method below.

Another common file container format is an image used by a virtual machine. The most common is the .vmdk file format, which is used in virtual machines created by VMware. This file container format was developed by VMware, but is now an open format used by other programs, such as VirtualBox and QEMU.

File containers created for virtual machines can be loaded into R-Studio as sector-by-sector images and analyzed to detect their file systems. These scans typically reveal many recognized partitions.
A .vmdk file-container scanned for its file system
Fig. 4: A .vmdk file-container scanned for its file system
Click image to enlarge

Files are found scattered across many recognized partitions. Depending on the circumstances, most of these files are recoverable, but some may not be.

Encrypted Hard Disks and Partitions

For file recovery from an Encrypted Linux Disk, read our article: Data Recovery from an Encrypted Linux Disk after a System Crash.

While encrypted disks are not technically the same as file containers, data recovery from a disk with full disk encryption is similar to recovering data from an encrypted file container. For example, BitLocker, which is included with certain Windows editions and includes drive encryption. Similarly, TrueCrypt/VeraCrypt allows you to encrypt an entire disk.

When unlocked using their native software, encrypted disks appear as logical disks in R-Studio's Drives pane and can be processed as such.
Fig. 5: A locked BitLocker disk in R-Studio's Drive pane
Fig. 5: A locked BitLocker disk in R-Studio's Drive pane
Click image to enlarge

An unlocked BitLocker disk in R-Studio's Drive pane
Fig. 6: An unlocked BitLocker disk in R-Studio's Drive pane
Click image to enlarge

Fig. 7: An unmounted VeraCrypt disk in R-Studio's Drive pane
Fig. 7: An unmounted VeraCrypt disk in R-Studio's Drive pane
Click image to enlarge

A mounted VeraCrypt disk in R-Studio's Drive pane
Fig. 8: A mounted VeraCrypt disk in R-Studio's Drive pane
Click image to enlarge

Note that if the data on an encrypted disk is damaged so severely that it cannot be unlocked using its native software, chances are very small that any data from it can be recovered. Scanning them reveals nothing.

Conclusion

There are numerous different file container formats, most of which can be processed by R-Studio for data recovery. Uncompressed disk images, virtual machine images and images created by R-Drive Image can be loaded directly. For data recovery from encrypted disks and images and proprietary file container formats, R-Studio can process these as normal logical volumes after they are mounted in the native software. But in all cases, if the file container format is corrupted to the point that it cannot be mounted, then the chances of recovering any files are very small.

Data Recovery Feedback
370 feedbacks
Rating: 4.8 / 5
I really love your R-Studio product, I am doing Data Recovery as a professional, I used RS since the early versions and I loved the product, as far as I can tell, R-Studio, especially the Tech Version (but including the standard) is one of the best and excellent tools for a pro to have in the arsenal of tools in a pro DR lab, especially combining with the specialized Data Recovery hardware providers like DeepSpar, and PC3000, the rest of `wannabees` out there are waste of time, strongly recommend
I lost more than 200K files from my NAS due to a mistake. I tried 3 different recovery solutions over the 4 TB raid disks, and all of them performed ok but to be honest none of them were able to Raw recover the files and rename them with meaningful names out of the Metadata like R-TT did, then I was able to sort again my files and pictures and kind of restore all of them.

R-TT may not be the easiest or most user-friendly solution, but the algorithm used for the renaming saved me THOUSAND of hours of opening ...
Just recovered my old ext4 partition with R-Studio after trying testdisk and R-Linux without success. That partition was overwritten by another ext4 partition and I was losing my hope until I tried R-Studio demo. It detected all my files and directories again!

Bought it and 100% recommend it for anyone with a similar issue.
Genuinely tried every free program available without luck of recovering a deleted file from months ago. Thinking my file was deleted forever and lose all hope I came across this website as a recommendation.

I was reluctant as it seemed pricey compared to other programs, but damn worth every penny. It managed to even find files I thought were wiped from existence.

Kudos to r-tools, thank you!
Why make incremental backups, when there is R-Studio?

I`m an IT professional who has worked from home for over a decade. Early on in my career, I configured an HP ProLiant Server (Raid 1+0) as a workstation that I would remote into from my laptop. As technology evolved, I began to use it only for email and as a config file repository.

A short while ago, one of the drives degraded, but the HP ProLiant Server (Raid 1+0) still functioned fine on the remaining drive. I was complacent and didn`t replace the ...