Advanced recovery with UFS Explorer

In case UFS Explorer is unable to undelete data with prompt undelete tool, file system not supports undelete or file system is damaged, you may use Advanced recovery tool.
'Advanced recovery' is the powerful tool, combining set of data analysis algorithms. It may allow recovering the data even from unknown or damaged file systems. Now it supports following methods of data recovery:

• File system reconstruction for damaged file systems;
• Lost file system structures detection. Allows recovering actual files from damaged file system or finding deleted files that are missed by prompt undelete.
• Signature-based file detection. Allows finding files by their types, using specific knowledge about file formats, specific headers and so on. In many cases allows to restore file even in case any information about file allocation and size is lost.
• Fragments detection. In case file is too fragmented to detect it by signatures, UFS Explorer can find file system-specific tables, trees and other objects that could store data allocation information of lost objects. This recovery option not always may give entire file, but if combined with signature-based search, it may give entire, consistent fragments of large fragmented files.

Additionally, UFS Explorer supports two methods of scan: optimized (free space only) and non-optimized (entire partition). Optimized scan mode detects current, existing files allocations and scans only 'free space' (data area, not taken by any existing files). It can significantly speed-up the scan, however it's not recommended to use this mode on damaged file systems (some 'existing' files might be not accessible normally).
UFS Explorer scans entire partition in non-optimized scan mode so all data is to be analysed.

To activate this tool, right click disk partition and choose 'Data Recovery: advanced scan'. UFS Explorer will show scan configuration dialog.


Specify scan parameters as following:

• Start at (sector) - relative offset from partition start to beginning of scan region. Default is 0. You may set non-zero value to scan only fragment of the partition;
• Number of sectors - size of scan region in sectors. Default is partition size. You may set lower value to scan only fragment of the partition;
• Scan free space only - paramter is active for any supported file system. If set, UFS Explorer will ignore disk space used by existing files. It's NOT recommended to set this flag for damaged/unreadable file systems;
• Use user-defined signatures - in case you defined own RAW recovery signatures set this flag in order to use them by scan engine;
• Use embedded recovery logics - enables UFS Explorer to use embedded RAW recovery signatures and internal files layout detection logics without file system metadata. This method should be turned on for 'undelete' scan and could be turned off for damaged file system reconstruction to reduce result set.
• File system-specific logics and reconstruction - enables UFS Explorer to take to account file system metadata. This tool is active for subset of supported file systems. If used for with damaged or formatted file system it gives chance to recover data with full directory tree and file names. On healthy file system along with 'Scan free space only' provides fast enough advanced 'undelete' method.

Set up these scan paramters and press 'OK'. UFS Explorer will start requested operations. Please note that 'Scan free space only' method on damaged file system might fail. In this case UFS Explorer will suggest full scan.

In case you are trying to 'unformat' or reconstruct damaged file system, it's critical to set 'File system-specific logics and reconstruction' flag. Inactive flag could mean supported file system is not detected. The reasons could be:

• Invalid partition type label - partition type does not match actual file system on partition. Use 'File systems: fast detect' tool to detect valid file system before running recovery tool;
• Damaged file system descriptor (superblock) - UFS Explorer is unable to detect valid file system on partition. In this case use Data Recovery: Lost superblock recovery (for partition) or Data Recovery: lost partitions for damaged partition table.

Scan result

After scan is completed, UFS Explorer shows scan result as virtual sub-partition for scanned partition.


Figure 2 shows this new virtual partition for scanned SGI XFS partition. You may now navigate this new virtual partition to see any recovered files.
Unlike original partition, the scan result partition would contain not only 'original' files (in case file system-sepcific logics is turned on) but also will show set of special folders. Among special folders are:

• [Detected by type] - contains files, detected with signature-based search and embedded recovery logics;
• [Duplicates] - contains file objects that are duplicated. For Windows Vista NTFS it could contain file versions;
• [Files and Fragments] - contains specific objects detected by file system metadata (usually - correctly detected file fragments);
• [Parent unknown] - contains file system files that were not classified by containing folder;
• [Scanned fragments] - contains one or more disk fragment references that were scanned.

UFS Explorer supports usual data access for this virtual file system.


Scan customization

See RAW recovery settings for details.


Backup

In case you need save scan result for future use, right click the virtual partition and choose 'Save Ultimate file recovery scan result'.
You may then restore scan result later: right click original partition, choose 'Load Ultimate file recovery scan result'. UFS Explorer will control if the data belongs to right partition.


Requirements

OS:	Windows 2000/XP/2003/Vista
Client Software:	UFS Explorer Standard Recovery/Professional Recovery/Business Network
File system:	ANY
File system-sepcifics for:	FAT12, FAT16, FAT32, NTFS, NTFS5, XFS, Ext2/3, UFS, UFS2

---

See also: RAW recovery settings, Undelete, Data Access, Help topics.