Directory tree reconstruction and file recovery - "Recovery".
In the overwhelming majority of cases of loss of information, nothing fatal happens, and the competent response of users and service
staff allows you to recover problems with their own hands. The biggest challenge is not to take any action
irreversible distortion of the sector space of the problem carrier.
At the same time, we must take care not about what to do, but about what NO NEED TO DO !
he main task is not to take actions that will lead to changes in the data on the media!
This primarily refers to the use of programs that make any adjustments to the sector space and
media repair programs. All these tools are designed to bring the state of the drives to the correct state.
(repair drives), and not to restore user data.
Repairs are performed by destroying parts of the data, among which, with a high degree of probability, the necessary data may be available.
The main advantages of the program Fomsoft Recovery NTFS include:
- Extremely respect for data integrity on problematic media.
In difficult cases, it may not cope with the task of data recovery, but it never worsens (aggravates) the current
media status.
- Having your own access mechanism to the directory tree and existing files, which eliminates access problems
Windows file system in case of physical failures and logical errors in building a binary tree of files and directories.
- The presence of a special adaptive mechanism that handles reading failures sectors of the problem disk.
- Flexible use of Internet technology, allowing the user to perform most of the work with their own hands and
effective use of assistance by Fomsoft Lab specialists.
The Fomsoft Data Recovery program uses its own file system access mechanism. This mechanism does not use functions.
Windows file system. Although the program does not have a high access speed, it does allow access to information when
physical failures of sectors of the sector space of the problem disk and destruction of the logical structure of binary index files.
For a complete reconstruction of the directory tree and data access, the program needs to specify one of the parameters:
- The letter of an existing logical drive;
- The physical address of one of the three elements of the file structure:
- boot sector of the logical sector:
- the beginning of the MFT table;
- records FILE Record.
Data recovery by problem logical drive letter.
In cases when the Windows operating system mounts a logical partition (partition) and assigns it a logical letter
disk, but subsequently cannot get full access to the directory tree and its files,
call the sub-item of the “Recovery” menu - “From the problematic logical disk”, fig. 24
Fig. 24. Recovering from a problem logical drive letter.
Data recovery by formatted drive letter.
n cases where, for one reason or another, a logical disk was accidentally formatted, it is possible to recover data from it that is not covered
new content. To do this, call the sub-item of the “Recovery” menu - “From a formatted disk”, fig. 24a.
Fig. 24a. Data recovery by formatted drive letter.
Query the identifier of the problem disk and filtering parameters.
After activating the functions described above, the dialog box for setting up additional modes and the search filter appears on the screen,
files needed by the user.
Fig. 25. Query the drive letter and filtering parameters.
After setting up additional parameters and filtering search by file extension and clicking the "APPLY" dialog button,
The program selects files in accordance with the search filter settings. The progress of this process is displayed on
the screen, fig. 33.
Recovery from NTFS boot sector data.
To restore the data to the partition's boot sector address, call the menu item
"Restore" - "From a virtual disk calculated" - "according to the boot sector data", Fig. 26.
Рис. 26. Menu - Data recovery from boot sector data.
In the dialog box that appears, you must enter the address of the boot sector, Fig. 27.
Fig. 27. An example of the completed data to recover data from the boot sector data.
After clicking the dialog button "RECORDER RECRUIT", the program reads the boot sector,
produces a virtual simulation
logical drive and displays the settings panel filter selection of user-specified files by their extensions.
Recovery to the address of the initial entry of the MFT table.
To reconstruct the directory tree at the address of the beginning of the MFT table, in the Windows file system, this entry is referred to as $MFT,
partition you need to call the menu item "Recovery" - "From the virtual disk, calculated" - "according to the $MFT data", Fig. 28
Fig. 28. Menu - Data recovery from the data file record $MFT.
In this case, the Fomsoft Data Recovery program displays the dialog box shown in Figure. 29.
Fig. 29. Menu - Data recovery from the data file record $MFT.
By pressing the dialog button "RECONSTRUCTION SURVEY", the program independently calculates the remaining parameters required for reconstruction,
and displays the settings panel for the search filter for files whose extensions the user specified.
According to the file entry FILE Record from the first fragment of the MFT table.
Using the address of any file entry from the first fragment of the MFT table that describes the non-resident file, you can calculate all the rest
parameters required for a complete reconstruction of the NTFS file system directory tree. For this
It is necessary to call the "Recovery" menu item - "From a virtual disk calculated" - "by file record FILE Record", fig. thirty.
Fig. 30. Menu - Data recovery from file record data FILE Record.
The most convenient entry is the entry that describes the $AttrDef system file. In fig. 31 is an example.
filling the dialog panel with the address $AttrDef describing the file $AttrDef on the hard disk
No. 1 for partition (section) No. 0.
Fig. 31. Menu - Data recovery from the data file $ AttrDef.
Arbitrary setting of parameters for searching and recovering data.
In case of significant file system corruption on the problem disk, you can enter the parameters using which the Fomsoft Data Recovery program
simulates a virtual logical disk and reconstructs the directory tree on the problem disk.
The program requires the following parameters to reconstruct the directory tree and restore files:
- Address of the boot sector or its copy.
- Address of the beginning of the file table or the address of its copy.
- The address of the file record FILE Record of any unfragmented file from the first fragment of the Main File Table.
- Address of the beginning of the logical disk on the hard disk.
- The number of sectors in a logical cluster
- A list of the physical addresses of the beginning and end of the fragments of the Main File Table.
o do this, select the menu "Data Recovery" - "From a virtual disk, calculated" - "arbitrary installation of parameters", Fig. 31a.
Fig. 31а. Menu - Free setting of parameters.
In the dialog box that appears, fig. 31b, you need to select the problematic hard disk and specify the physical addresses of the elements of the file system obtained
according to the results of the function "Diagnostics".
Fig. 31b Custom parameters dialog for searching and restoring data.
Customize the search filter and select custom files.
After pressing the "RECONSTRUCTION START" dialog box, Figures 27, 29, 31 and 31b, the setup panel is displayed.
filter for selecting files needed by the user pic. 32.
Fig. 32. Configuring the search filter files needed by the user.
The progress of the directory tree reconstruction process is displayed on the display screen, fig. 33.
Рис. 33. Displays the progress of the search and selection of the desired files.
Download the result of the previous reconstruction.
In the process of reconstructing the directory of the problem disk, the program generates a log file FomsoftDataRecoverySave.bin,
which is placed in the folder from which the program was launched.
This file contains all the data about the reconstructed directory tree of the problem disk. It can be saved elsewhere.
or refer to experts for advice. In order not to waste time on reconstruction, you can call
submenu item "Load reconstruction result", fig. 33a:
Fig. 33a. Download the result of the previous reconstruction.
After activating this sub-item, the program reads the previously saved log file FomsoftDataRecoverySave.bin,
will check for the presence of a problem disk on the computer and display the result of its previous reconstruction.
If the problem disk is not detected, the program will display a corresponding message on the screen, fig. 33b:
Fig. 33b. Problem disk not found, view only possible.
Trial recovery of files from 1 to 64 KB.
After the process of searching and selecting the necessary files is completed, the reconstructed directory tree is displayed on the screen.
In fig. 34 shows the image of the free version of the program.
Fig. 34. Reconstructed directory tree.
The image output format for the licensed version remains the same, but instead of the dialog button
"[REQUEST LICENSE PROGRAM]]", the button "[RECOVE MARKED FILES]" is displayed.
The generated tree is displayed in two columns, the first one contains the actual directory tree, and the second one displays the list
subdirectories and a list of files contained in the selected directory. The display list consists of eleven columns.
presented in the table below:
| № | The displayed value in the column | Note
|
|---|
| 1 | Folder or file name
|
|
|---|
| 2 | File size in bytes
| This field is empty for the folder
|
|---|
| 3 | ate and time of creation
|
|
|---|
| 4 | Modification date and time
|
|
|---|
| 5 | Expansion
| Three character DOS extension
|
|---|
| 6 | Sign of deleted item
| Contains the text "Deleted" for deleted files or folders
|
|---|
| 7 | Contains the text "Deleted" for deleted files or folders
| Used for debugging, the size is set to zero.
|
|---|
| 8 | FIRE Record Number in MFT Table
|
|
|---|
| 9 | LBA sector records FIRE Record in the MFT table
| This is the address of the physical sector on the disk
|
|---|
| 10 | LBA address of the beginning of the data file on disk
| The physical address of the beginning of the first piece of data file
|
|---|
| 11 | Number of file fragments
|
|
|---|
To control the correctness of the recovery result found by Fomsoft Data Recovery,
Before you use the commercial recovery of all found files, the user can perform free
trial recovery of some part of files.
The user can check or uncheck the box next to the name of the file or folder, as well as dialog buttons
[Select All] and [Redeem All], thus noting the files of interest. After clicking the dialog button
[TRIAL EXTRACT] The program will extract the selected files to verify the recovery.
Marked files and making a decision to restore all the found information. At the same time, the program reports that
trial recovery will be performed only for non-fragmented files from 1 to 64 KB in length, fig. 35.
Fig. 35. Warning about trial restore files.
After clicking the dialog button [Yes], the program will ask you to specify the location of the folder for recording
extracted files.
Having checked the result of the trial recovery of information, the user can decide on his further actions..
Restore all found folders and files.
In the case of using the licensed version, the user can click the [RESTORE MARKED FILES] dialog button.
In this case, the program will transfer to the Fomsoft Lab's server the serial number of the hard disk from which you need to recover
files. If the serial number of this disk is not in the list of licensed disks, the program will ask the user to confirm
licensing of this disk, fig. 36
Fig. 36. Free License Usage Request.
If the serial number of this hard drive is in the list of licensed disks, the program will ask you to specify a local or
network drive, where and write the marked files and folders.
If you use the free version of Fomsoft Data Recovery , the user can
give the program a command to send the request for making the Licensed Instance to Fomsoft Laboratory by pressing the dialog button
[REQUEST FOR LICENSE PROGRAM].
In this case, the user gets the opportunity to use the Licensed version of the program on several media, regardless of the breakdown
on logical drives.
The cost of licensing a single disk is significantly reduced from the ordered amount of serviced media.
Order a licensed version of the data recovery program Fomsoft Data Recovery.
Fig. 37. Order to purchase a license for the program Fomsoft Data Recovery.
Four license options are available:
| № | Number of carriers | Cost per media | Total cost
|
|---|
| 1 | 1 | 9 euro | 9 euro
|
|---|
| 2 | 2 | 8 euro | 16 euro
|
|---|
| 3 | 5 | 7 euro | 35 euro
|
|---|
| 3 | 10 | 5 euro | 50 euro
|
|---|
The delivery time of the Licensed Instance of Fomsoft Data Recovery by default is
no more than 24 hours (two days).
If the User wants to speed up the delivery process, he may additionally pay:
- $10 or 600 rubles. Delivery speed no more than 12 working hours.
- $15 or 900 rubles. Delivery time no more than three business hours.
At the same time, it is necessary to agree on the technical feasibility of the execution of the Order.
After receiving the Order, the Fomsoft Lab server automatically sends to the specified email address
Customer letter with a request to confirm the need to fulfill the Order. If confirmation is not received,
Order is ignored.
Manual recovery, writing physical sectors to a file.
The program allows you to restore the file of interest to the user, indicating to her the physical disk, the starting address of the file data,
as well as the number of sectors or a specific address of the end of data sector. To do this, call the sub menu
"Restore" - "Write disk sectors to file", Fig. 38.
Fig. 38. Menu - Write sectors from disk to file.
After calling this menu, the dialog box for entering the corresponding parameters appears on the screen. 38a.
Fig. 38a. Dialog box for entering parameters of the file being restored.
The specific value of the parameters can be taken from the reconstructed directory tree (Fig. 34). In fig. 38b is a fragment
reconstructed directory tree describing 5 source code files. Based on this data, you can easily restore
4 files. In fig. 38a shows the parameters for extracting the data of the first file:
| № | Parameter | Parameter value | Note
|
|---|
| 1 | Name of the file being restored | DataRecoveryDSP.asm |
|
|---|
| 2 | The starting address of the fragment on the disk | 36544 |
|
|---|
| 3 | The end of the fragment or the number of sectors | 2938 | Estimated value file length/512,
rounded to integer value with excess
|
|---|
| 4 | FILE NAME | Wirk.asm | The name of the recorded file
|
|---|
| 4 | CURRENT CATALOG | F:|Masm32\-FomsoftDataRecovery |
|
|---|
| 4 | Disk ID | HD2 |
|
|---|
Fig. 38b. Fragment of the reconstructed directory tree.
|
