File recovery with recover my files

Once you have confirmed that your data has been successfully recovered, assess what you now wish to do with the problem drive. E.g. Use Windows to copy the recovered files back onto it, or replace the problem hard drive with a new drive. 8.2 When to use a File Recovery search

Deleted files will remain on a computer up until such time as they are overwritten by new data. For this reason you should minimize the use of the drive on which the files were lost until such time as you have had the opportunity finish your data recovery.

Your C: drive is the most vulnerable to new data simply because it is where Windows is running. If practical you may consider connecting the drive to another PC as a secondary and then using that computer to run the search.

In critical situation, you may also consider taking a drive image (a sector by sector copy of the entire drive) and working on the image rather than the original drive. For more information see Chapter 15 – Drive Imaging.

When running a Recover Files search it can be advantageous to boost your PC power settings so that problems are not encountered with drives powering down during the recovery or the save process. See Chapter 7 for more information. 8.4 Running a Recover Files search

Size: The size column contains the size of the physical or logical device. Note that the actual size of the drive is usually smaller than what the drive is labeled. Drive manufactures usually round up the drive capacity, so a 453.99 GB drive in this screen may be sold as 500GB.

Each file on a Windows computer has a record in the file-system index (e.g. the FAT or MFT). When a file is deleted, the record is updated with a deleted file marker. The clusters on the drive used to store the file data are now considered unallocated (i.e. available for new storage). However the file content remains in those clusters. A search for deleted files reads the entire file-system index, including records for deleted files, and displays the file content.

Recover My Files will then commence to read the file-system. This search will take less than 20 minutes to complete. At the completion of the search review the search results as described in 8.5 below. If files are NOT found, try the option to “Search for deleted files, and then search for selected Lost File types”. 8.4.2 Search for deleted files, then search for selected “Lost File” types

A lost file is a file that is located by f ile carving. File carving is a sequential search of the drive to find file headers for the specified file types. Learn more about lost files at the beginning of this manual – Data Recovery Fundamentals. This search should be run when:

• Place a select tick in the box next to the file types that you wish to recover. The file types in this list have a known structure that can be identified if found on the drive (a full list is provided at Appendix 2 – File carving). To search for a file type, type the extension into the “Find File Extension” search box.

Important: The more file types that are selected, the more resource intensive is these search and the longer the search will take. It is suggested that you do not perform a Lost File search for more than 10 files at any one time. A sequential search of a large hard drive, e.g. 2TB or more containing many files may take up to 24 hours.

The Folders view shows all files and folders on the examined drive. The “ Root” folder contains the existing folder and file structure on the drive. Deleted files and folders are located inside the Root folder and should appear in their original location prior to delete. Lost and Orphaned files are placed in their own folders under the partition in which they were found.