R-Studio is designed to recover data from physical hard drives and other media. But it can also be used to recover files that have been stored in virtual disks or file container formats. File containers often include all the same parts of a real disk-including a boot record, disk partitions, file systems and individual files and folders. File containers can be uncompressed, compressed or encrypted. In addition, there are utilities that can encrypt an entire disk.

The method for recovering data from a file container depends on its format. This article covers data recovery methods using R-Studio for the most common file container formats.

Types of File Containers with Disk Images

There are several types of file container formats that function as disk images:

• Uncompressed disk images - This is a sector-by-sector copy of a disk created from a logical volume or an entire physical drive. This type of disk image can be loaded into R-Studio and processed like any other image.
• Proprietary file containers - Some utilities use their own disk image formats. Proprietary disk images are usually compressed or encrypted. For example, R-Drive Image, a disk imaging, backup and copying utility developed by R-TT, Inc., creates file containers with the .rdr file extension.
• Encrypted file containers - These are similar to proprietary file containers, but the contents are also encrypted. Only the software used to create the image can mount and read it. If the encrypted container can be mounted in the native software, it can be detected by R-Studio and processed as a normal logical disk.
• File containers from virtual machines - These are file container formats that are meant to be mounted by a virtual machine, such as a VirtualBox or VMware. These can be loaded in R-Studio as uncompressed images and scanned for partitions.

Uncompressed Disk Images and R-Drive Image File Containers

Uncompressed disk images can be loaded directly into R-Studio. Likewise, R-Drive Image files are natively supported by R-Studio and can be loaded directly and processed like any other image or disk. See the R-Studio's help: Image

Fig. 1: File containers with disk images in R-Studio
Click image to enlarge

Proprietary File Container Formats

R-Studio can also process certain proprietary disk images, even if they are not natively supported by R-Studio. This can be done by mounting the file container as a virtual disk using the proprietary software. The contents of the file container will appear in the R-Studio Drives pane as a logical disk and can be processed as such.

Fig. 2: A file container mounted as a virtual disk by a proprietary disk imaging program
Click image to enlarge

Note that if a proprietary file container is corrupted to the point that it cannot be connected using its native software, R-Studio can still load it as an uncompressed image and attempt to process it. However, in these cases, chances are small that useful data can be found, especially if the image is compressed.

Encrypted File Container Formats

Some proprietary file container formats are encrypted. This means that the data is unreadable unless it is mounted by its native software (usually using a decryption key). Disk encryption can be applied to a partition, disk image or an entire physical drive (see below . Examples of such programs are the freeware TrueCrypt/VeraCrypt from IDRIX and the free-for-home-use R-Crypto from R-TT, Inc.

Those programs connect their file-containers as virtual logical disks and provide background data encryption/decryption. Such virtual disks appear in the R-Studio Drives pane as logical disks and can be processed as such.

Fig. 3: File containers connected to computer as virtual disks by VeraCrypt and R-Crypto
Click image to enlarge

Unlike compressed proprietary file format containers, if an encrypted disk is corrupted to the point where it cannot be mounted by its native software, then it is nearly impossible to recover data from it. This is because the background encryption/decryption cannot be performed-although R-Studio can perform a sector-by-sector scan of the image, the data won't be recognizable.

File Containers from Virtual Machines

The ideal method for recovering files from a virtual machines is described in the article Data Recovery from Virtual Machines. If this can't be performed, use the method below.

Data recovery from a VHD file used in Microsoft Virtual PC is described in the article Data Recovery from Virtual Hard Disk (VHD) Files. If this can't be performed, use the method below.

Another common file container format is an image used by a virtual machine. The most common is the .vmdk file format, which is used in virtual machines created by VMware. This file container format was developed by VMware, but is now an open format used by other programs, such as VirtualBox and QEMU.

File containers created for virtual machines can be loaded into R-Studio as sector-by-sector images and analyzed to detect their file systems. These scans typically reveal many recognized partitions.

Fig. 4: A .vmdk file-container scanned for its file system
Click image to enlarge

Files are found scattered across many recognized partitions. Depending on the circumstances, most of these files are recoverable, but some may not be.

Encrypted Hard Disks and Partitions

For file recovery from an Encrypted Linux Disk, read our article: Data Recovery from an Encrypted Linux Disk after a System Crash.

While encrypted disks are not technically the same as file containers, data recovery from a disk with full disk encryption is similar to recovering data from an encrypted file container. For example, BitLocker, which is included with certain Windows editions and includes drive encryption. Similarly, TrueCrypt/VeraCrypt allows you to encrypt an entire disk.

When unlocked using their native software, encrypted disks appear as logical disks in R-Studio's Drives pane and can be processed as such.

Fig. 5: A locked BitLocker disk in R-Studio's Drive pane
Click image to enlarge


Fig. 6: An unlocked BitLocker disk in R-Studio's Drive pane
Click image to enlarge


Fig. 7: An unmounted VeraCrypt disk in R-Studio's Drive pane
Click image to enlarge


Fig. 8: A mounted VeraCrypt disk in R-Studio's Drive pane
Click image to enlarge

Note that if the data on an encrypted disk is damaged so severely that it cannot be unlocked using its native software, chances are very small that any data from it can be recovered. Scanning them reveals nothing.

Conclusion

There are numerous different file container formats, most of which can be processed by R-Studio for data recovery. Uncompressed disk images, virtual machine images and images created by R-Drive Image can be loaded directly. For data recovery from encrypted disks and images and proprietary file container formats, R-Studio can process these as normal logical volumes after they are mounted in the native software. But in all cases, if the file container format is corrupted to the point that it cannot be mounted, then the chances of recovering any files are very small.