Customization of RAW recovery

UFS Explorer RAW recovery allows signature-based search customization. In case you are sure about specific file format signatures or you want to find specific file(s), you may define own rules for signature based search. Comparing to simple data search with any disk editor/viewer program, UFS Explorer gives the following advantages:

• UFS Explorer combines all known signatures to delimit file fragments automatically and thus can really simplify data classification;
• UFS Explorer may classify disk space by used/unused criteria so it may exclude data fragment that are in use by existing files.

To process with RAW recovery rules customization, choose tool from main menu: 'Settings' -> 'RAW recovery signatures'. Program will display main signatures customization form.


The form contains classification tree of all known signatures and technical folders. User-defined signatures are displayed at bottom, under '!User defined' branch with alternative icons.

The following options are available here (see program main menu):

• Load signatures from file - replaces current list of user-defined signatures by signatures file content;
• Add signatures from file - extends current list of user-defined signatures with signatures file content;
• Save signatures - saves current list of user-defined signatures to file. File is in specific format, supported by UFS Explorer only for future use;
• View properties - shows properties of currently selected signature. Alternative is double-click to tree node. Specific properties exist for user-defined signatures only;
• New signature - shows form for adding new file class signature;
• Remove signature - removes currently selected signature. Works for user-defined signatures only;
• Clear signatures - removes all user-defined signatures.

To add/view/edit any user-defined signature, same signatures properties form is used.


Signature consists of the following components:

• Name - the virtual folder name that would be displayed after data search with RAW recovery under '!User defined' virtual folder (mandatory);
• File extension - the default extension to be assigned for data fragments that would be detected with the signature (optional);
• Rules - set of rules to classify the file. Consists of 'type', 'offset' and 'value'. Common meaning f rule is: IF DATA at 'offset' MATCHES 'value'. Type is given for easier signatures manipulation only. All rules of signature are processed with boolean AND. In case you need boolean OR - you may add different, alternative signature. Rules are mandatory.

You may manage rules with 'Add', 'Remove' and 'Properties' buttons. Double-click to rule also invokes properties form.


Select rule type, enter ruled data offset and enter value to search. There are few data types supported. Actual value format depends of data type.

• BYTE - byte value. Enter integer number from 0 to 255. You may use '0x' prefix to specify hexadeciamal value (0x0..0xFF);
• WORD - 16 bit integer value. Enter integer number from 0 to 65535. You may use '0x' prefix to specify hexadeciamal value (0x0..0xFFFF);
• DWORD - 32 bit integer value. Enter integer number. You may use '0x' prefix to specify hexadeciamal value (0x0..0xFFFFFFFF);
• QWORD - 64 bit integer value. Enter integer number. You may use '0x' prefix to specify hexadeciamal value (0x0..0xFFFFFFFFFFFFFFFF);
  Note: integer values are always displayed in interface as decimal values, not hexadecimal.
• BINARY (HEX) - binary data, up to 256 bytes. You should specify spece-delimited set of hexadecimal digits in range 00..FF (bytes). Example: '00 45 FF 0F 44'.
• ASCII - byte string (8bit char). Specify the string up to 256 symbols.
• UNICODE - unicode string (16bit char). Specify the string up to 128 symbols.

Requirements

OS:	Windows 2000/XP/2003/Vista
Client Software:	UFS Explorer Standard Recovery/Professional Recovery/Business Network
File system:	ANY

---

See also: Advanced recovery, Data Access, Help topics.