R-Studio uses a unique IntelligentScan technology when it tries to recover the data on the area being scanned.
While scanning the selected area, R-Studio reads data directly from the disk,
analyzes them, and tries to determine a record to which the data belong. The following
record types are possible:
- MBR record
- NTFS Boot sector record
- FAT Boot sector record
- MFT record
- NTFS Folder record
- FAT record
- FAT Folder record
- Ext2FS SuperBlocks record
All these record types have different, but known, structure. Knowing valid values
of record fields and relations between them for each record type, R-Studio
determines a record type for the data. If such record type cannot be unambiguously
determined, the data are assigned to the most probable record type. The same data can
be assigned to several record types, with a certain probability for each assignment.
A list of possible files is generated from these records.
R-Studio generates a record list for each record type. This list contains
references to records assigned to a record type from the list with their assignment
probability. The same data can be included into different record lists. Then
R-Studio analyzes relations between elements in each list and between different
lists, and generates a list of found partitions with their parameters, such as
partition start point and probable size, file system type, cluster size, and existence
probability.
Using the file list and partition list, R-Studio reconstructs file systems and
files on the found partitions. One file can be attributed to several different
partitions.
When the entire hard disk or its part has been scanned, R-Studio shows all
found partitions. Then the parameters of the found partitions may be manually
corrected, if additional information on them is available.
Using the IntelligentScan technology, R-Studio can recover files not only on
new and existing partitions. It also can find and recover data on partitions that
have been deleted or reformatted. If, for example, there was an NTFS partition,
which later was reformatted as a FAT partition, R-Studio will show two
partitions on the same place on the disk, one having the FAT file system,
the other the NTFS. Then, found files can be recovered.
|