The Wayback Machine - https://web.archive.org/all/20050125022901/http://www.r-tt.com:80/FAQ.shtml
R-TT Home
 

 
 FAQ

We select frequent questions and requests from our customers and public them in the Frequently Asked Questions (FAQ) Base.

Data Recovery
File Undelete
Drive Image
Data Security
File Encryption
E-Mail Recovery
MS Word Recovery
PC Privacy
Disk Cleaning
Linux Recovery
R-Studio
R-Undelete
R-Drive Image
R-Firewall
R-Guard
R-Mail
R-Word
R-Wipe&Clean
R-Linux

Contact Us Feedback Site Map



1. I lost my information. What are guidelines I should follow before and during restoring data?
2. From which drives will R-Studio family utilities recover files?
3. How can I use the network features of R-Studio Network Edition?
4. Where can R-Studio family utilities save recovered files?
5. Will R-Studio family utilities recover long file names? Will it recover localized names?
6. Which NTFS file extended information can R-Studio restore? Is there any restriction or guidelines?
7. Is it safe to use R-Studio? Can it destroy data on disk?
8. I have tried to open a drive with deleted files, but R-Studio failed to open it or shows much less of the deleted files. What can I do?
9. I have scanned the drive, but contents of recovered files do not match original one. What can I do?
10. What is the best way to recover files from hard drive with bad sectors?
11. What if I apply the Restore command to the files not being deleted?
12. I have deleted partitions. Moreover, I have created new partitions where the old ones were located. Can R-Studio help me?
13. I have a broken volume set/stripe set/raid5 volume. Moreover, I can't see the volume. I only see the drives on the volume thay were created. Can R-Studio help me in this situation?
14. In Hex Viewer/Editor I see tabs named 'Std', 'Direct', etc. What do they mean and how can I use them?
15. When viewing NTFS files in the Hex Viewer I see a lot of items in left window such as 'Standard information', 'Data', etc. What do all they mean?
16. Why can I see more files after scanning than I see in Windows Explorer? How I can filter deleted files only?
17. I see folders named as '$$$Folder58448' or so. All they have a red X on them. What does it mean?
18. After scanning FAT volume I see files with strange names, which actually were never present on the volume. I even get FAT16 partitions on FAT32 volume. Why do they all appear?
19. What does 'Fixup out of bounds' mean?
20. What the difference between R-Studio and R-Undelete?
21. How can I recover my Linux Ext2 partition if R-Studio works only under the Windows operating system?
22. I see the new version of R-Studio on your site. Can I update my version?
23. I need to recover files from other file system I bought R-Studio originally or want to run network recovery now. How can I upgrade to the proper version of R-Studio?
24. I created an image of the hard drive. It stops at about 4Gb. Why?
25. I emptied the Recycle Bin. Can I still recover deleted files?
26. My computer does not boot Windows anymore. How should I proceed to recover data?
27. What is the rule of thumb for data recovery?
28. My MBR is damaged. Can R-Studio restore it?
29. What do all the colors of Recognized partitions mean?
30. When I recover files I get "Can't read file to be recovered completely (801)". What does it mean?
31. When opening a partition I see some files marked with a red cross, some without. Does the red cross means that the file is unrecoverable?

1. I lost my information. What are guidelines I should follow before and during restoring data?

OS considers deleted files as just free space on the drive. With any write operations to that partition or disk, there is always the possibility of losing these files forever by overwriting them. Therefore, do not write anything to the data drive, do not run any disk utilities such as chkdsk and defragmenters and do not reboot the computer. Windows can spawn chkdsk during start-up procedure. To avoid write operations during restoring, do not restore files or write images into the drive that contains deleted files.

You can also create an image of the drive with deleted files (from "Drive" menu select "Create Image File") and save one on another drive. This image can be later used instead of the original drive. That is the way to save the current state of the drive. All R-Studio family utilities (including Demos) support the creation and use of image files of the same format.


2. From which drives will R-Studio family utilities recover files?

Under Windows NT, Windows 2000, or Windows XP operating systems R-Studio will recover files from all physical and logical drives, which are visible by OS. Under Windows 95, Windows 98 or Windows ME R-Studio will recover files from all logical drives visible by OS and from all physical drives, which are correctly accessible by Windows protected mode I/O subsystem. R-Studio network edition will also recover files from drives of remote computers if they are running R-Studio Agent or R-Studio Agent Emergency (see Q3).


3. How can I use the network features of R-Studio Network Edition?

In order to recover files on remote computers, the special service program R-Studio Agent should be installed on that computer. You may also use R-Studio Agent Emergency which boots from a single floppy and provides the same functions. These programs gives access to disks on remote computers therefore all network transfers are encrypted with strong crypto algorithms using a password supplied by the administrator.
To access drives on a remote computer choose 'Connect to remote...' from the 'Drive' menu, then either select a computer from the list of computer, or enter the host name or IP address and password, which is set for R-Studio Agent on the remote computer. When the connection is established you will see all drives of the remote computer in 'Drives Windows' and you will be able to use them the same way as a local one.


4. Where can R-Studio family utilities save recovered files?

On to any device that is accessable by your operating system. Files may also be recovered to network share specified by UNC path (such as \\myserver\myshare). You may select the recovery path from a standard Windows directory dialog or enter it manually. Please note, the file system of the drive, which is used for saving recovered files may limit recovery of NTFS files extended information (see Q6 for details).


5. Will R-Studio family utilities recover long file names? Will it recover localized names?

On Windows NT, Windows 2000, or Windows XP operating systems R-Studio will recover files with file names to 32000 characters and restore original file names in any national encoding.
Under Windows 95, Windows 98, or Windows ME there is a 255 characters limit for size of full path for recovered files. Encoding of a file name is limited by the language currently set in Windows. Files with other characters encoding will also be restored, however the file name will be altered to fit the limitations of Windows.


6. Which NTFS file extended information can R-Studio restore? Is there any restriction or guidelines?

R-Studio supports recovering of compressed files, alternative data streams, encrypted files, file security and extended file attributes. If the OS that is running R-Studio and the drive to which you are saving files support particular extended information, then they are recovered to their original state, which includes extended information inside the file. Otherwise, extended information will be saved as standalone files, which have the same name as the restored file and an additional extension, which qualify the type of extended information. Here is a quick reference for the host OS and target drive needed to recover particular extended information while embedding it into the recovered file:

Extended information Required host OS Required target drive FS
Encrypted files Windows 2000 or XP NTFS
Alternative data streams Windows NT, 2000 or XP NTFS
Files security Windows NT, 2000 or XP NTFS
Extended files attributes Windows NT, 2000 or XP NTFS or FAT



7. Is it safe to use R-Studio? Can it destroy data on disk?

R-Studio may write to disk only from hex editor (with enabled write) or when it is explicitly directed to save files on this disk. Therefore, you should be very carefully using hex editor. In all other modes and actions, R-Studio performs a read-only and never modifies data on partitions and drives directly.


8. I have tried to open a drive with deleted files, but R-Studio failed to open it or shows much less of the deleted files. What can I do?

Select physical drive, on which your files were stored.
Scan it ('Drive'->'Scan') in order to find file system information.
Recognized partitions will appear under scanned drive in 'Drives Windows' tree view.
Open partition, which contains your files or explore all of them if you are not sure about choice of correct partition.
Select files you want to restore and recover them ('Tools'->'Recover') to another drive.


9. I have scanned the drive, but contents of recovered files do not match original one. What can I do?

If the file has the wrong contents there are two possible reasons for this situation; either the place, which the deleted file occupied, was overwritten permanently or the wrong Recognized partition was chosen for recovery.
In order to find the correct partition please perform the following:
Scan physical drive, which contains the deleted file (from 'Drive' menu select 'Scan').
Explore all partitions found after scanning, then try to restore a file which size is greater than 2KB.
If you find contents of the recovered file to match the original one, then use that partition for recovering.
Absence of the partition means that file information was overwritten permanently.


10. What is the best way to recover files from hard drive with bad sectors?

To get the best result, choose Create Image File command from Drive menu (or context menu) to copy the damaged data to another hard drive. You can create the Image of segments of the partition, Image of the whole partition, or even Image of the full hard drive.
To adjust the number of attempts to read bad sectors, use I/O Tries in Drive Control properties. After the Image is created, you can open the Image using Open Image File command, and work with it as with original drive. (See also Q24)


11. What if I apply the Restore command to the files not being deleted?

In this case R-Studio will just copy these files. Their NTFS permissions may be disregarded by command. Even files locked by the system (such as registry hives or pagefile) can be copied. In a sense, R-Studio interface does not make a difference between existing, deleted, and lost files. It gives you an option to restore given file using all available information with simply 100% of success for existing files.


12. I have deleted partitions. Moreover, I have created new partitions where the old ones were located. Can R-Studio help me?

See Q8 and Q9 answers.


13. I have a broken volume set/stripe set/raid5 volume. Moreover, I can't see the volume. I only see the drives on the volume thay were created. Can R-Studio help me in this situation?

Yes. Create virtual volume of appropriate type from 'Drive' menu. Select created volume, tab 'Parents', drag and drop by icons drive which constitute given volume, from left panel to the right. You get a new virtual volume which acts as a usual drive so it can be opened, scanned for files, and so on.


14. In Hex Viewer/Editor I see tabs named 'Std', 'Direct', etc. What do they mean and how can I use them?

These tabs represent different representations of the same file. There are following currently implemented representations:
Std: Standard. Represents file according to all known information. When the file is restored, its' data will be equal to data seen in this representation.
Unlimited: Represents all file information, stored in clusters associated with given file. If there is some information which resides beyond claimed size of file it will be shown (unlike 'Std' representation).
Direct: Represents all file information as well as 'Unlimited' representation. However if file is compressed by Windows NT data will not be uncompressed but shown as is (unlike 'Unlimited' representation).
Allocation: Represents resident part of NTFS file. If file is resident (one which fits inside MFT record) this representations equal to 'Std', otherwise it shows 'MFT Runs' - data which describes cluster allocation of given non-resident file.


15. When viewing NTFS files in the Hex Viewer I see a lot of items in left window such as 'Standard information', 'Data', etc. What do all they mean?

Each NTFS file is actually a set of sub-files or 'attributes' in NTFS terminology. Each of them has one defined type and unique name. Windows NT uses some of the attributes to store file information. For example, the unnamed attribute with type 'Data' is equal to the file's contents unnamed attributes with type 'Standard information' stores file times and user mode permission (read-only, archive:). Other attributes may be created and used by some 3rd-party software. In hex viewer/editor you can review all of file's attributes.


16. Why can I see more files after scanning than I see in Windows Explorer? How I can filter deleted files only?

R-Studio works with a hard drive at low level, not through the driver for the file system.
If you want to view deleted files only, clear checkmark Deleted Files in File Types dialog (File Mask command from Tools menu).


17. I see folders named as '$$$Folder58448' or so. All they have a red X on them. What does it mean?

Folder's name like '$$$Folder58448' means that folder itself was not found on drive but some references to one were. For example, folders 'My documents', 'Work', 'Photos' were found and all they have one parent folder, whose description wasn't actually found on drive, so its name is unknown and therefore presented as '$$$Folder58448'. Perhaps the description of such folders was just outside of the scan area - so try to expand region or scan the entire hard disk. If it does not help the description of the folder has been most likely overwritten.


18. After scanning FAT volume I see files with strange names, which actually were never present on the volume. I even get FAT16 partitions on FAT32 volume. Why do they all appear?

Unlike NTFS, the FAT file system barely contains redundant information, and sometimes it is impossible to check disk information. That is why R-Studio shows all possible directory entries whatever they are, to ensure recovering of a maximum number of files.


19. What does 'Fixup out of bounds' mean?

MFT record (the one which holds information about particular file) contains some self-validation values. One of them is known as 'fixup'. So if MFT record is broken, then following warnings can appear:
 
'[FileId: XX] Fixup out of bounds'
'[FileId: XX] Fixup XX is XX, but should be XX'
 

They are not fatal errors. They mean that information describing file system information for a file is most probably overwritten. If so, there is a risk that file can't be recovered.


20. What the difference between R-Studio and R-Undelete?

R-Undelete is a light version of R-Studio. It recovers files only on local logical disks visible by host OS. It usually suffices when files or folders are simply deleted. However if you are to recover files from deleted or damaged partitions, from damaged RAIDs, or from remote computers through network, you need one of R-Studio version.


21. How can I recover my Linux Ext2 partition if R-Studio works only under the Windows operating system?

You need to attach your Linux drive to another computer which can boot from Windows, and then restore the files on that computer using R-Studio. No matter how that system recognizes your drive, R-Studio should access it. You may also run R-Studio Agent Emergency which boots up from the single floppy and allows R-Studio to access data on that computer over the network.


22. I see the new version of R-Studio on your site. Can I update my version?

Yes, we provide free update of all our products. You may update to the latest version of R-Studio from Registered User's Console.


23. I need to recover files from other file system I bought R-Studio originally or want to run network recovery now. How can I upgrade to the proper version of R-Studio?

Please visit Registered User's Console to see possible options and make an on-line upgrade.


24. I created an image of the hard drive. It stops at about 4Gb. Why?

You have likely created the image on the FAT32 file system which has a 4Gb file size limitation. Therefore larger files can not be created there. If this is the case, we would suggest that you either use NTFS (through network or attaching the drive to a Windows NT/2000/XP/2003 box if you are running Windows 9x/ME) or split your drive into regions each less than 4Gb, create their images and make virtual volume set afterwards if you need to recover files from there.


25. I emptied the Recycle Bin. Can I still recover deleted files?

When the file is deleted into Recycle Bin it is not actually deleted. It is just moved to \Recycler (or \Recycled) folder and renamed in such a way that many files from different folders but with the same name can be placed there. Information on original names with original location of files is kept in registry.

After deleting file from Recycled Bin there is no way to recover original name and location. But you should be able to restore it from \Recycler (or \Recycled) folder using R-Studio if you can identify it by size (it will be marked by red cross as deleted) unless it is overwritten permanently.


26. My computer does not boot Windows anymore. How should I proceed to recover data?

R-Studio works on Windows 95/98/ME/NT/2000/XP/2003 only. It will not work under DOS or another operative system which fits into one bootable floppy. Therefore, you should attach your hard drives to another computer which can boot to Windows, and then restore files on that computer using R-Studio. No matter how that system recognizes your drives, R-Studio should access it.

If you have a Network Card installed on the computer with lost files, you may try R-Studio Agent Emergency which boots from a single floppy and allows R-Studio access data on that computer over the network.


27. What is the rule of thumb for data recovery?

See Q8 and Q9.


28. My MBR is damaged. Can R-Studio restore it?

R-Studio recovers lost files from deleted or damaged partitions to another location. For safety reasons it does not even try to recover partitions in the wrong locations.


29. What do all the colors of Recognized partitions mean?

To facilitate file recovering, recognized partitions are marked by color. Partitions marked by green are most probable source for recovering, by orange - the second best, by red - still worth looking for.


30. When I recover files I get "Can't read file to be recovered completely (801)". What does it mean?

It means that the file under consideration extends beyond the partition it resides on. That means either severe data lost or that you use wrong Recognized partition to recover the file. Please explore all such partitions.


31. When opening a partition I see some files marked with a red cross, some without. Does the red cross means that the file is unrecoverable?

A Red cross on the icon means that file has been deleted and will have to be recovered to be accessed by the system. That is it. Files without the red cross are not marked as deleted. They may be lost from the system due to file structure corruption (especially when found on Recognized partitions.)



If you don't find an answer to your question above, please fill out the Technical Support Request Form for technical question
or Purchasing Request Form for purchasing request and you'll be contacted by our support professionals in the order in which your request was received.



Buy On-line ||   Registered User's Console ||   Get Invoice ||   Purchasing Request ||   Technical Support Request