The Wayback Machine - https://web.archive.org/all/20050212152950/http://www.r-tt.com:80/FAQ.shtml
OS considers deleted files as just free space on the drive. With any write
operations to that partition or disk, there is always the possibility of
losing these files forever by overwriting them. Therefore, do not write
anything to the data drive, do not run any disk utilities such as chkdsk and
defragmenters and do not reboot the computer. Windows can spawn chkdsk during
start-up procedure. To avoid write operations during restoring, do not restore
files or write images into the drive that contains deleted files.
You can also create an image of the drive with deleted files (from "Drive"
menu select "Create Image File") and save one on another drive. This image can
be later used instead of the original drive. That is the way to save the current
state of the drive. All R-Studio family utilities (including Demos)
support the creation and use of image files of the same format.
|
|
Under Windows NT, Windows 2000, or Windows XP operating systems R-Studio will
recover files from all physical and logical drives, which are visible by OS.
Under Windows 95, Windows 98 or Windows ME R-Studio will recover files from
all logical drives visible by OS and from all physical drives, which are
correctly accessible by Windows protected mode I/O subsystem. R-Studio network
edition will also recover files from drives of remote computers if they are
running R-Studio Agent or R-Studio Agent Emergency (see Q3).
|
In order to recover files on remote computers, the special service program
R-Studio Agent should be installed on that computer. You may also use R-Studio
Agent Emergency which boots from a single floppy and provides the same
functions. These programs gives access to disks on remote computers
therefore all network transfers are encrypted with strong crypto algorithms
using a password supplied by the administrator.
To access drives on a remote computer
choose 'Connect to remote...' from the 'Drive' menu, then either select a computer
from the list of computer, or enter the host name or IP address and
password, which is set for R-Studio Agent on the remote computer. When the connection
is established you will see all drives of the remote computer in 'Drives Windows'
and you will be able to use them the same way as a local one.
|
|
On to any device that is accessable by your operating system. Files may also
be recovered to network share specified by UNC path (such as
\\myserver\myshare). You may select the recovery path from a standard Windows
directory dialog or enter it manually. Please note, the file system of the
drive, which is used for saving recovered files may limit recovery of NTFS
files extended information (see Q6 for details).
|
On Windows NT, Windows 2000, or Windows XP operating systems R-Studio will
recover files with file names to 32000 characters and restore original file
names in any national encoding.
Under Windows 95, Windows 98, or Windows ME
there is a 255 characters limit for size of full path for recovered files.
Encoding of a file name is limited by the language currently set in Windows. Files
with other characters encoding will also be restored, however the file name
will be altered to fit the limitations of Windows.
|
R-Studio supports recovering of compressed files, alternative data streams,
encrypted files, file security and extended file attributes. If the OS that is running
R-Studio and the drive to which you are saving files support particular
extended information, then they are recovered to their original state, which includes
extended information inside the file. Otherwise, extended information will be saved as
standalone files, which have the same name as the restored file and an additional
extension, which qualify the type of extended information. Here is a quick reference
for the host OS and target drive needed to recover particular extended information
while embedding it into the recovered file:
| Extended information |
Required host OS |
Required target drive FS |
| Encrypted files |
Windows 2000 or XP |
NTFS |
| Alternative data streams |
Windows NT, 2000 or XP |
NTFS |
| Files security |
Windows NT, 2000 or XP |
NTFS |
| Extended files attributes |
Windows NT, 2000 or XP |
NTFS or FAT |
|
|
R-Studio may write to disk only from hex editor (with enabled write) or when
it is explicitly directed to save files on this disk. Therefore, you should be very
carefully using hex editor. In all other modes and actions, R-Studio performs
a read-only and never modifies data on partitions and drives directly.
|
Select physical drive, on which your files were stored.
Scan it ('Drive'->'Scan') in order to find file system information.
Recognized partitions will appear under scanned drive in 'Drives Windows' tree view.
Open partition, which contains your files or explore all of them if you are
not sure about choice of correct partition.
Select files you want to restore and recover them ('Tools'->'Recover')
to another drive.
|
If the file has the wrong contents there are two possible reasons for this situation;
either the place, which the deleted file occupied, was overwritten permanently
or the wrong Recognized partition was chosen for recovery.
In order to find the correct partition please perform the following:
Scan physical drive, which contains the deleted file (from 'Drive' menu select 'Scan').
Explore all partitions found after scanning, then try to restore a file which
size is greater than 2KB.
If you find contents of the recovered file to match the original one, then use that
partition for recovering.
Absence of the partition means that file information was overwritten permanently.
|
To get the best result, choose Create Image File command from Drive menu (or
context menu) to copy the damaged data to another hard drive. You can create
the Image of segments of the partition, Image of the whole partition, or
even Image of the full hard drive.
To adjust the number of attempts to read bad sectors, use I/O Tries in
Drive Control properties. After the Image is created, you can open the Image
using Open Image File command, and work with it as with original drive.
(See also Q24)
|
|
In this case R-Studio will just copy these files. Their NTFS permissions may
be disregarded by command. Even files locked by the system (such as registry
hives or pagefile) can be copied. In a sense, R-Studio interface does not make
a difference between existing, deleted, and lost files. It gives you an option
to restore given file using all available information with simply 100% of
success for existing files.
|
|
Yes. Create virtual volume of appropriate type from 'Drive' menu. Select
created volume, tab 'Parents', drag and drop by icons drive which
constitute given volume, from left panel to the right. You get a new
virtual volume which acts as a usual drive so it can be opened, scanned
for files, and so on.
|
These tabs represent different representations of the same file. There are following currently implemented representations:
Std: Standard. Represents file according to all known information.
When the file is restored, its' data will be equal to data seen in this representation.
Unlimited: Represents all file information, stored in clusters associated
with given file. If there is some information which resides beyond claimed size of file
it will be shown (unlike 'Std' representation).
Direct: Represents all file information as well as 'Unlimited'
representation. However if file is compressed by Windows NT data will not be
uncompressed but shown as is (unlike 'Unlimited' representation).
Allocation: Represents resident part of NTFS file. If file is resident (one
which fits inside MFT record) this representations equal to 'Std', otherwise it
shows 'MFT Runs' - data which describes cluster allocation of given non-resident file.
|
|
Each NTFS file is actually a set of sub-files or 'attributes' in NTFS
terminology. Each of them has one defined type and unique name. Windows NT
uses some of the attributes to store file information. For example, the
unnamed attribute with type 'Data' is equal to the file's contents unnamed
attributes with type 'Standard information' stores file times and user mode
permission (read-only, archive:). Other attributes may be created and used by
some 3rd-party software. In hex viewer/editor you can review all of file's
attributes.
|
R-Studio works with a hard drive at low level, not through the driver for the
file system.
If you want to view deleted files only, clear checkmark Deleted
Files in File Types dialog (File Mask command from Tools menu).
|
|
Folder's name like '$$$Folder58448' means that folder itself was not found on
drive but some references to one were. For example, folders 'My documents',
'Work', 'Photos' were found and all they have one parent folder, whose
description wasn't actually found on drive, so its name is unknown and
therefore presented as '$$$Folder58448'. Perhaps the description of such
folders was just outside of the scan area - so try to expand region or scan
the entire hard disk. If it does not help the description of the folder has been
most likely overwritten.
|
|
Unlike NTFS, the FAT file system barely contains redundant information,
and sometimes it is impossible to check disk information.
That is why R-Studio shows all possible directory entries whatever they are,
to ensure recovering of a maximum number of files.
|
MFT record (the one which holds information about particular file) contains
some self-validation values. One of them is known as 'fixup'. So if MFT record
is broken, then following warnings can appear:
'[FileId: XX] Fixup out of bounds'
'[FileId: XX] Fixup XX is XX, but should be XX'
They are not fatal errors. They mean that information describing file
system information for a file is most probably overwritten. If so, there is a
risk that file can't be recovered.
|
|
R-Undelete is a light version of R-Studio. It recovers files only on local
logical disks visible by host OS. It usually suffices when files or folders
are simply deleted. However if you are to recover files from deleted or
damaged partitions, from damaged RAIDs, or from remote computers through
network, you need one of R-Studio version.
|
|
You need to attach your Linux drive to another computer which can boot from
Windows, and then restore the files on that computer using R-Studio. No matter how
that system recognizes your drive, R-Studio should access it. You may also run
R-Studio Agent Emergency which boots up from the single floppy and allows
R-Studio to access data on that computer over the network.
|
|
Yes, we provide free update of all our products. You may
update to the latest version of R-Studio from
Registered User's Console.
|
|
Please visit Registered User's Console
to see possible options and make an on-line upgrade.
|
|
You have likely created the image on the FAT32 file system which has a 4Gb file
size limitation. Therefore larger files can not be created there. If this is the case,
we would suggest that you either use NTFS (through network or attaching the
drive to a Windows NT/2000/XP/2003 box if you are running Windows 9x/ME) or split
your drive into regions each less than 4Gb, create their images and make
virtual volume set afterwards if you need to recover files from there.
|
When the file is deleted into Recycle Bin it is not actually deleted. It is
just moved to \Recycler (or \Recycled) folder and renamed in such a
way that many files from different folders but with the same name can
be placed there. Information on original names with original location
of files is kept in registry.
After deleting file from Recycled Bin there is no way to recover
original name and location. But you should be able to restore it from
\Recycler (or \Recycled) folder using R-Studio if you can identify it
by size (it will be marked by red cross as deleted) unless it is
overwritten permanently.
|
R-Studio works on Windows 95/98/ME/NT/2000/XP/2003 only. It will not work under DOS
or another operative system which fits into one bootable floppy.
Therefore, you should attach your hard drives to another computer which can
boot to Windows, and then restore files on that computer using R-Studio. No
matter how that system recognizes your drives, R-Studio should access it.
If you have a Network Card installed on the computer with lost files,
you may try R-Studio Agent Emergency which boots from a single floppy and
allows R-Studio access data on that computer over the network.
|
|
R-Studio recovers lost files from deleted or damaged partitions to another location.
For safety reasons it does not even try to recover partitions in the wrong locations.
|
|
To facilitate file recovering, recognized partitions are marked
by color. Partitions marked by green are most probable source
for recovering, by orange - the second best, by red - still
worth looking for.
|
|
It means that the file under consideration extends beyond the partition it
resides on. That means either severe data lost or that you use wrong
Recognized partition to recover the file. Please explore all such partitions.
|
|
A Red cross on the icon means that file has been deleted and will have to be
recovered to be accessed by the system. That is it. Files without the red cross
are not marked as deleted. They may be lost from the system due to file
structure corruption (especially when found on Recognized partitions.)
|
© Copyright 2000-2005 R-tools Technology Inc.
