1. Starting a Recover Files Search

Quick Start Tips

• Don't panic, most deleted or missing data can be recovered;
  
• Minimize the use of your computer until you have had the opportunity to try data recovery software;
  
• Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

• install Recover My Fils on the C: drive of the 'good' computer, and
  
• use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

Searching for Deleted Files

On a computer storage device, the term 'Filesystem' is used to describe the schema by which electronic files are stored. The most common File Systems are;

• Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

• Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

• Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

• Apple Macintosh HPFS (High Performance File System); and

•  Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk, including user deleted files. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

Eventually deleted file entries in the File System will be reused as new data is written to the computer. For this reason, the sooner a search is for deleted files is conducted after a deletion, the greater the chance of a recovery using this technique.

When a file has been found with its original file name, it has been found by locating a File System record for that file which points to the location of the file data on the disk. In a successful recovery, it should be possible to click on the file found in the results window and preview its content, or save the file and open it normally. If the recovered file does not contain valid data, the possible reasons are:

1. The file system record is pointing to the correct location on the disk, but that section of the disk has been over-written with new data and no longer contains the correct data for this file. In this case, nothing can be done as the original file has been overwritten and destroyed; or

2. The file system record is corrupt and no longer points to the correct location on the disk. In this case, the additional search for the Lost Files type will attempt to locate the file by its file structure. If the "Search for deleted files, then search for "Lost File" types" option does not locate the file, run a "Lost File" search over the entire drive, by clicking Options > Advanced > and select Start with a Lost File scan and Scan for lost files across the whole device (and not only in the free space)

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

• it is a sequential search of the drive and does not track the fragmentation of files;

• Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".