User Guide - Live CD [email protected] Data Studio - recovery toolset

75 Pages·2003·0.67 MB·English

User Guide
Version Number 2.0
File Recovery 2.0 END-USER LICENSE AGREEMENT
Copyright (c) 1998-2002 Active Data Recovery Services. All rights reserved.
IMPORTANT-READ CAREFULLY
This End-User License Agreement ("EULA") is a legal agreement between you (either an individual or a single entity) and The
Active Data Recovery Services for the
Contents
1 OVERVIEW
What Happened to my Data? ..............................................................................................................................1
Welcome to
NTFS Master File Table (MFT) ........................................................................................................................41
NTFS File Types..................................................................................................................................................42
NTFS File Attributes....................................................................................................................................42
NTFS System Files .......................................................................................................................................43
NTFS Multiple Data Streams......................................................................................................................44
NTFS Compressed Files ..............................................................................................................................45
NTFS Encrypted Files (Windows 2000 only) ..........................................................................................45
NTFS Sparse Files (Windows 2000 only)..................................................................................................46
Data Integrity and Recoverability with NTFS.................................................................................................47
Recovering Data with NTFS.......................................................................................................................47
Cluster Remapping........................................................................................................................................47
6 THE FILE RECOVERY PROCESS
Disk Scanning for Deleted Entries ...................................................................................................................50
Defining the Chain of Clusters..........................................................................................................................53
Recovering the Chain of Clusters......................................................................................................................55
7 THE PARTITION RECOVERY PROCESS
System Boot Process ...........................................................................................................................................57
Partition Visibility..........................................................................................................................................57
Other Partition Recovery Topics ................................................................................................................58
MBR is Damaged.................................................................................................................................................59
Blank Screen on Startup...............................................................................................................................59
Operating System Not Found.....................................................................................................................60
Partition is Deleted or Partition Table is Damaged........................................................................................61
Partition Boot Sector is Damaged.....................................................................................................................63
Missing or Corrupted System Files...................................................................................................................65
Emergency Repair Process ..........................................................................................................................65
Recovery Console..........................................................................................................................................66
Recovery Software ........................................................................................................................................66
8 TROUBLESHOOTING
“UNREGISTERED VERSION” Message .............................................................................................67
Maximizing Chances of Recovering Files..................................................................................................67
Getting the Trial Version .............................................................................................................................67
Restoring Files ...............................................................................................................................................67
Windows 2000, Windows XP .....................................................................................................................68
Windows 3.x ..................................................................................................................................................68
Browser Support ...........................................................................................................................................68
Non-English File Names .............................................................................................................................69
Long File Names...........................................................................................................................................69
Disk Image .....................................................................................................................................................69
Recovery Tips.......................................................................................................................................................69
OVERVIEW
1
What Happened to When a file is written to a hard drive, two separate systems come into play:
my Data?
• Record of that file is kept in the Root Table or Master File Table (MFT)
• Physical hard drive addresses are labelled as 'occupied'. These addresses are
physical locations called clusters.
When file is deleted from a hard drive, the same two systems are notified:
• The file record in the Root Table or MFT indicates the file has been deleted.
• Clusters are labeled as 'unoccupied'.
In the event of an accidental file deletion it is strongly recommended to perform the
recovery operation as soon as possible. If any new files are written to the same drive,
there is a chance that the file-writing process may have allocated these
Welcome to
2 CHAPTER 1: OVERVIEW
• Windows NT
• Windows 2000
• Windows XP
USING
4 CHAPTER 2: USING
Searching for Deleted Files and Folders 5
Searching for Use this method when you are not certain where the deleted file or folder was stored
Deleted Files and before it was accidentally deleted. If you know where the deleted file or folder should
Folders be, you can use Device Scan procedure as described above.
Follow the steps below:
1 Check the Windows Recycle Bin to see if the file or folder is there. If it is, use standard
Windows Restore command to recover it from there. If not, continue with step 2.
2 If you are not certain where the deleted file or folder was before it was deleted, try to
reduce the size of the search by not searching through those folders on the drive where
you know it would not have been.
3 When you have chosen a folder where the deleted data might have been:
• Click the Search button on the toolbar, or right-click the drive or folder and click
Search in the context menu.
• Define a search pattern in Filter Files dialog. For example, type *.TXT to find all
files with “TXT” extension. Check Deleted Only to hide non-deleted files and
folders.
Figure 2-2 Define a Search Pattern

• By default, the filter pattern is not case sensitive. If you want to make it case
sensitive, enable the Match Case check box.
• Click Find. After the search is complete, examine folders on the left that contain
matched files
The search pattern used here is the same pattern recognized when searching in
Microsoft Windows.The asterisk symbol (*) in the pattern means that at this place can
be zero or any number of any symbols. The question mark symbol (?) in the pattern
means that at this place can be any single symbol.
Some examples are listed below:
* All file on the drive or in the folder
*.TXT All fields with “TXT” extension
My*.* All files starting with “My”
MyFile.txt Search for the file named “MyFile.txt”
See Also: Performing Extended Device Scan, Searching for Deleted Files and Folders
6 CHAPTER 2: USING