Quick Start Tips

• Don't panic, most deleted or missing data can be recovered;
  
• Minimize the use of your computer until you have had the opportunity to try data recovery software;
  
• Avoid writing any new data to the problem drive (or you may overwrite and destroy files that could otherwise have been recovered).

A good methodology, if possible, is to connect the problem drive to another computer as the secondary drive. This enables you to

• install Recover My Fils on the C: drive of the 'good' computer, and
  
• use it to scan the secondary 'problem' drive to recover your files.

This methodology make it far less likely that Windows, or you, will write new data to the drive.

Of course this methodology is not always practical, as you may well have lost your files from your current C: drive and have no alternative that to continue to use Windows on this drive. Recover My Files is a small program (approximately 10mb), so installation of the software onto the problem drive, whilst not recommended, is a small risk.

If you see your files - Save Them!

It may sound silly, but when attempting to recover data, if you get to the position where you can see your missing files in the Recover My Files preview window - save them! Don't mess about trying lots of different options or ideas, or put off the saving to another day. Once the files are recovered and you have a nice secure copy of these files on another drive, then you can experiment all you want.

The drive selection window displays the following information:

·        logical drive letter, e.g. "C:"

·        the drive label (if no label has been give it will display "{no label}"

·        the size of the drive, eg. 453.99 GB (note that the actual size of the drive is usually smaller than what the drive is labelled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive may be marketed as a 500GB).

·        the format of the drive, e.g.

§        NTFS

§        FAT

·        describes the way in which the drive is connected to the computer

§        SCSI - Small Computer System Interface, is a set of standards for physically connecting and transferring data between computers and storage devices

§        ATA -   an interface standard for the connection of storage devices such as hard disk and CD-ROM in computers. Includes Parallel ATA (PATA) and Serial ATA (SATA)

§        1394 - The IEEE 1394 interface (commonly referred to as FireWire) is a standard for high-speed communications used commonly for digital audio of multimedia drives

§        SSA - Serial Storage Architecture is a serial transport protocol used to attach drives to servers.

§        Fibre - Optic Fibre connection

§        USB - USB connection

§        RAID Types

o       JBoD

o       RAID 0

o       RAID 5

·        describes the means by which the drive is being accessed

§        S - SCSI Pass Through Interface

§        W - Windows

§        F - File

§        T - TCPIP

§        M - Mixture of the above types

Options in the drive selection window include:

  This button is used in for RAID recovery. Learn more here.

   This button is used to add image files to the drive selection list, including DD, EnCase, FTK, SafeBack, AFF (Recover My Files Professional only).

  This button refreshes the list of available drives to search.

Check connections, is the drive alive?

Ensure the drive you are wanting to search is properly connected to your computer. Check all cables etc. Can you hear the drive spinning? If it is silent, or making and unusual noise, then it is likely that it is a physical hardware problem and you will need to contact a hardware data recovery service.  

Does your computer know that a drive is connected? To find out, right click on

My Computer > Manage" > Disk Management

and you should see a "Disk X" that is the size of your problem drive. (Note: In the Windows Disk Management screen, "Disk0" is usually the physical drive on which your C:\ partition resides).

Is the file system damaged?  

It is possible that your file system is damaged to the extent where you can no longer see your drive letter. Click the "Back" button to return to the search selection window and choose the "Recover Drive" option. Do you see the "Disk" listed (you should be able to identify it by it's displayed size). If the Disk is listed, continue with the Drive Recovery option.

Are you connecting directly to a digital camera?  

Some digital cameras have a proprietary connection to your computer which Recover My Files cannot recognize as a drive letter.   In this case you will need to use a digital camera card reader, an inexpensive device into which your digital camera memory card is inserted and then connected to your PC (usually via a USB connection).

Are you trying to connect to an iPod Touch, iPhone or similar device?  

Some of these products have proprietary protection which prevents software from gaining access to the drive letters.

Searching for Deleted Files

On a computer storage device, the term 'Filesystem' is used to describe the schema by which electronic files are stored. The most common File Systems are;

• Microsoft's FAT (File Allocation Table), usually used for external media and camera cards;

• Microsoft's XFAT, an enhanced version of FAT for improved performance on external media and camera cards;

• Microsoft NTFS (Maser File Table, [MFT]), primarily used for PC hard drives;

• Apple Macintosh HPFS (High Performance File System); and

•  Linux EXT2/3.

A common characteristic of a File System is that they use a table on the drive to track every file on the disk, including user deleted files. Each record in the table holds all information about a file, including its size, time and date stamps, permissions, etc., (required for file and folder name recovery), and tells the computer which storage sectors on the drive hold the file data.

Eventually deleted file entries in the File System will be reused as new data is written to the computer. For this reason, the sooner a search is for deleted files is conducted after a deletion, the greater the chance of a recovery using this technique.

When a file has been found with its original file name, it has been found by locating a File System record for that file which points to the location of the file data on the disk. In a successful recovery, it should be possible to click on the file found in the results window and preview its content, or save the file and open it normally. If the recovered file does not contain valid data, the possible reasons are:

1. The file system record is pointing to the correct location on the disk, but that section of the disk has been over-written with new data and no longer contains the correct data for this file. In this case, nothing can be done as the original file has been overwritten and destroyed; or

2. The file system record is corrupt and no longer points to the correct location on the disk. In this case, the additional search for the Lost Files type will attempt to locate the file by its file structure. If the "Search for deleted files, then search for "Lost File" types" option does not locate the file, run a "Lost File" search over the entire drive, by clicking Options > Advanced > and select Start with a Lost File scan and Scan for lost files across the whole device (and not only in the free space)

Searching for Lost Files

Recover My Files has the capability to perform a sequential search of the disk to identify "Lost Files" by their internal file structure, (i.e. their header, content and footer). This is often referred to as a "file header search" or "data carving".

Shown below is the content of a JPEG picture, the way a computer sees it. A JPEG can be identified by the "y0ya..JFIF" header, and contains further information about the camera used to create the image:

Once the header of a file is identified, Recover My Files will travel a pre-defined distance down the drive to analyze the file structure and locate the end of the file.

If the file end is not found, but sufficient information is found within the file to suggest it will at minimum be partially recovered, it is assigned a default file size according to that file type. The global default size of lost files can be set in the OPTIONS > SEARCH window:

Limitations of a Lost File search are:

• it is a sequential search of the drive and does not track the fragmentation of files;

• Lost Files do not have a file name (as file names are held only in the file system records and not with the file data) and are called "LostFile_FileType_X".