User Guide
Table of contents
The very first start
Finding an existing or lost drive
The user interface
Recovering lost or deleted files
Finding lost or deleted files
Finding lost data
Viewing lost or deleted files
Other options
If you are trying to recover data from a removable media, you need to have the media in the drive before running FILERECOVERY. Before running the program under Windows NT-based environment, make sure that you have administrator privilege.
Once the program is loaded, you may choose your language. Afterwards a wizard appears leading you through the recovery process. This guide will explain an advanced, manual recovery procedure to you. Hence you can close the wizard and select Open Drive from the button bar.
The drives of your computer will be detected. If the scanning window will not disappear after a certain time, a complete lookup causes your computer to crash because one drive may be incompatible with the software and you can omit it by restarting the software and selecting Options from Object menu.The appearing window will display a list of all accessible drives found on both Windows logical drives and physical drives in your system. If your drive is listed under 'Logical drive', select your drive which contains the deleted files or directories.
If the drive containing the deleted files your are looking for is not listed, this is a sign of more severe corruption and you may need to proceed with the next step Finding an existing or lost drive.*
If the drive your are looking for is listed, but the filesystem format is wrong, you should select it and click 'Full scan/ find format'.*
NOTE: If you select a drive that uses the FAT system, you can choose the FAT number to be used for the program (used for accessing directories) if you click on 'Scan options -> Drive Access'. In most cases the option "FAT 1" is correct. Select 'no FAT' if you accidentally reformatted your drive. Select 'FAT 2' if you know that your first FAT is damaged.
For more information on recovering files on a specific file system refer to File System Issues.After selecting OK the drive will be searched for deleted files and directories (only if the selected drive uses NTFS system). After the search is complete the user interface appears. Proceed with section user interface.
Finding an existing
or lost drive*
If your drive is not listed under 'Logical drive', FILERECOVERY must search for your lost drive. The following sequentially (sector-by-sector) search process can be adjusted to accelerate processing speed and to reduce memory usage. Please notice that it is very recommended on computers with low memory ( < 192 MB) to switch off all of the following options that are not needed. The search options can be accessed if you click on Scan options. If you keep the default options, the maximum possible data will be found, but the search will require more time to complete. These are the options for the drive scan process:
Find FAT drive data | If
enabled, FAT drive
data information including files and directories will be found. This is
the prefered method if the drive's boot
sector or other important drive information is damaged. Found drives of this type are named as "rebuilt" in the logical drive list. |
Find NTFS drive data | If
enabled, NTFS drive
data information including files and directories will be found. This is
the prefered method if the drive's boot
sector or other important drive information is is damaged. Found drives of this type are named as "rebuilt" in the logical drive list. |
Find lost files (raw data) |
If enabled, lost files will be searched by a file signature search algorithm. This is the prefered method if your drive is severe corrupted and no directory or file information is found. This is a last resort in recovering data from a severely corrupted drive. This option
will typically recover small files that are stored in one cluster
or larger files stored in consecutive clusters on the disk. The lower
your drive is fragmented,
the more effective the result will be. If drives
of this type were found, they are named as "RawFS" in
the logical drive list.
|
Before starting the search select a physical drive under tab sheet 'Physical drive' which contains your lost drive. After selecting Quickscan the following window will appear.
This dialog window allows you to delimit the search. In most cases the default setting can be retained. Click on OK to start the search.
After the search has completed (or canceled by the user), the additional found drives will be listed under 'Logical drive' and marked as
. Depending on the extent of the disk corruption there can be found the following drive types:
- Drives with lost boot sector (marked as "lost")
If the drive your are looking for is still not listed you should repeat the previous step by clicking 'Full scan/ find format'. After completion of the scan, additional drives of the following type can be found:
- Drives without boot sector (marked as "without BootSec")
- Drives without boot sector that were rebuilt in memory with files and directories found during search (marked as "rebuilt")
- Drives without any drive information (marked as "RawFS")
For more information on recovering lost files refer to File System Issues.
This list ist sorted from a very good resulting recovery to a less good resulting recovery. Select your drive and click on OK. The drive will be searched for deleted files and directories (only if the selected drive uses NTFS system). After the search is complete the following user interface appears.
The user interface of the program is as follows:
Below the program title there is the menu bar (1). Further below there is the button toolbar (2) from which the most important points of the program can be accessed. The directory tree (3) and the file list view (4) are used to navigate through your drive.
The parts of the program are now described in detail:
The directory tree contains as highest elements the folders Root, Deleted and Searched.
![]() |
contains the directory structure including normal (not deleted) files and directories as it would be displayed by any other file browser |
![]() |
contains the directory structure including deleted files and directories |
![]() |
displays the result of a user file search operation |
![]() |
displays the result of a find lost data operation |
Each folder contains a directory tree of the following form:
![]() |
The drives
directory structure contains the folders of the drive and you may click
into directories as you would do with Windows Explorer. Once a directory
is selected the file list view at the right will show all files and directories
of the selected directory. |
Once you click on a folder in the directory tree a list of files and directories will be displayed in the file list view at the right:
The following information will be shown in the different columns:
Symbol |
Used to
distinguish existing and deleted files. Existing files are marked as |
Name | Name
of the file or directory. The file name may have a "_" as the
first symbol. This first character can be changed for all files by
selecting Options from Object menu.
The entire individual filename can be changed by selecting Rename
from Object menu or by using the popup menu. If multiple files were found with the same name it is always the best practice to change the file names before saving them. |
Size | The size in bytes (1024 bytes=1 Kilobyte). The size can be modified by selecting Properties from Object menu. The default size for lost files can be changed by selecting Options from Object menu and choosing tab sheet 'Files'. |
Date modified | Last time the file was changed, updated or edited |
Cluster | The cluster where the file begins on a FAT system |
MFT entry | The MFT (master file table) entry on a NTFS system |
Condition | The condition of deleted files/directories. May be either poor (the file cannot be recovered at all), fair (a part of the file may be recoverable), good (the entire file may be recoverable) or unknown. |
Type | Description providing detailed information about the type of the file |
Location | Location of the file. If the file or directory has been discoverd by a user search, the location will indicate the original folder location. |
Sorting after specific criteria
The items in the file list view can be sorted by column. Simply click on the header of one column to sort for the specific criterium the column describes. To change the sorting from ascending to descending and vice versa click again the same column header.
![]()
Changing type of view
If there are many items in the file list view you can display them as list, as small, or as large icons. To change the type of view choose the desired option from the View menu.
The popup-menu
Most actions for recovering can be accessed from the popup-menu. This appears if your right click a selected file or directory:
Recovering lost or
deleted files
Once a drive has been opened and the file has been found in the file list view, select the file you wish to recover. To select multiple files either use the Shift key (to select several files in succession) or the Ctrl key (to select individual files) of your keyboard. If you wish to select all items in the file list view choose Select all from Edit menu.
Select "Save to..." from Object menu or click on the save button in the toolbar. Alternatively, if you select a single file you can choose "Save and view..." from Object menu to first save your file and then view it with the software applicable to the type of the file recovered.
The following window will appear:
![]()
Now select the drive and folder for the destination of the file to be recovered. This destination can either be another hard drive, a local network drive, a Zip or Jaz drive, or a floppy drive. Please notice that it is very much recommended, never to save the files to the drive or partition you recovered the data from. Otherwise other lost or deleted data could be overwritten.
If you wish to create a new directory, select the "Create..." button and select OK.NOTE: If the file is recovered from a FAT system, you can choose the FAT number which should be used for existing (normal) files. In most cases the default option is correct. Select 'no FAT' if you accidentally reformatted your drive. Select 'FAT 2' if you know that your first FAT is damaged.
For more information on recovering files on a specific file system refer to File System Issues.
Recovering multiple directories and files
It is not recommended to save the contents of an entire drive in one operation. The reason for this is, that many files and directories with the same name may be found (there may also be deleted files and existing files with the same name). To speed up recovery time and insure a system that works well, the suggested method of recovery is to retrieve your own data files (documents, sheets, drawings, images, database files, etc.) and re-install any software applications.
With many of files and directories to view, finding a particular file in a tree display can be difficult. The find option makes finding files your need much easier. If you know the name, extension, time, date, size or type of the file you are looking for, you can search the entire drive for a specified file or files with this option.
Once a drive has been opened you can search your deleted file by selecting Find from Object menu. The following window will appear:
![]() |
If you are looking for files of a specific name, you can enter a file filter string. The search is very flexible allowing multiple wildcards within the search. The wildcard character are the '*' and '?' symbols. The '*' can replace a file name, parts of a file name or a file extension. The '?' can replace a single character in a file name or extension. In the following there are some examples of wild card searches. NOTE: When using this option it is important to remember that deleted files may have the '_' symbol as first letter on FAT systems. Therefore it is usually best to leave out the first letter of the file name to be searched. |
Examples:
If you are looking for: | Use this: | You get back: |
All files named "mybusiness" with multiple extensions. | mybusiness.* | Mybusiness.mdb, mybusiness.doc, mybusiness.xls or any other file named mybusiness regardless of the extension |
Files named "mybusiness1.doc", "mybusiness2.doc", "mybusiness3.doc" etc. | mybusiness*.doc | The search will return all files starting with "mybusiness" with the .doc extension. So you will get "mybusiness1.doc", "mybusiness2.doc", etc. |
If you are looking for files containing the word business. | business | All files containing business, for example "monkey_business.doc", "business_funny.xls", "noneofyourbusiness.ppt", "mybusinessonly.mdb". |
Advanced search optionsThe advanced options allow you to search files by date, type and size. Click on Search options, select a search option and click on Start to begin the file search.
Once the search has finished, the found files can be found in theSearched folder of directory tree. To recover a searched file proceed as described in section Recovering lost or deleted files.
If you know you are using the right drive and you have performed this file search but your drive does not contain the entire files/directories, there may be lost files on your drive. Therefore proceed as described in the next step "Finding lost data".
If you know you are using the right drive and you have performed the user file search but your drive does not contain the entire files/directories, there may be lost files on your drive. A very typical -but not limited to- case would be if you accidentally formatted or reinstalled your drive.
This sequentially search (cluster-by-cluster) search allows you to get back this lost data.
After selecting Find lost data from Tools menu, the following window will appear.
This dialog window allows you to limit the search to a particular range of the current drive. In most cases the default setting can be retained. Click on OK to start the search.
After the search has completed (or canceled by the user), the found files can be found in the
Lost folder of directory tree. To recover a searched file proceed as described in section Recovering lost or deleted files.
If you did not disable the "find lost files" option under menu "Object/Options/Scan options", there will be also detected lost files by a signature search algorithm. These files can also be found in the
Lost folder of directory tree below the directories found. If the file size of these lost files could not be detected, they will have the default size specified under menu "Object/Options/Scan options ". If the size of the found lost file is too small, you can adjust the size for each single file by selecting Properties from Object menu.
For more information on recovering lost files refer to File System Issues.
By selecting View as from Object menu, you can view a selected file as text, hexdump or via the in-build viewer.
The hexdump will show the data of the file in a new window as it is stored physically on-disk. The left side of that window will show the data as a series of bytes in hexadecimal form and the right side will show the data series represented as ASCII text.
The text viewer will interpret the data series of the file as ASCII (if the deleted data is no plain-text the text viewer will stop at the first occuring special character).
The in-build viewer will show common file formats in a seperate window. Since for most types the viewer needs to create a temporary file on your system drive, it is recommended not to use this option if you need to recover files of your system drive. Otherwise these temporary files could overwrite your deleted data.
By selecting Options from Object menu, you can adjust the following settings:
Display |
|
Files |
|
Scan options |
|
Drive access |
|
* this feature applies only to FILERECOVERY Professional Edition
FILERECOVERY
is a registered trademark of LC Technology International, Inc
Microsoft
and Windows are trademarks of Microsoft Corporation. All other trademarks are
the property of their respective owners.