Recover My Files is a data recovery program that uses
file carving File carving is the process of reassembling computer files from fragments in the absence of
filesystem metadata.
Introduction and basic principles
All filesystems contain some metadata that describes the actual file system. At a minimum, this inc ...
to extract lost files from unallocated clusters. Recovery is based on the interpretation of file content, usually through the process of reverse engineering a file type.
It can be used to recover data from external and internal
hard disk
A hard disk drive (HDD), hard disk, hard drive, or fixed disk is an electro-mechanical data storage device that stores and retrieves digital data using magnetic storage with one or more rigid rapidly rotating platters coated with mag ...
s, in
FAT
In nutrition, biology, and chemistry, fat usually means any ester of fatty acids, or a mixture of such compounds, most commonly those that occur in living beings or in food.
The term often refers specifically to triglycerides (triple es ...
,
NTFS
New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft. Starting with Windows NT 3.1, it is the default file system of the Windows NT family. It superseded File Allocation Table (FAT) as the preferred f ...
,
HFS HFS may refer to:
Computing
* Hardware functionality scan, a security mechanism used in Microsoft Windows operating systems
* Hierarchical File System, a file system used by Apple Macintosh computers
* Hierarchical File System (IBM MVS), used MV ...
and
HFS+
HFS Plus or HFS+ (also known as Mac OS Extended or HFS Extended) is a journaling file system developed by Apple Inc. It replaced the Hierarchical File System (HFS) as the primary file system of Apple computers with the 1998 release of Mac OS 8. ...
file system
In computing, file system or filesystem (often abbreviated to fs) is a method and data structure that the operating system uses to control how data is stored and retrieved. Without a file system, data placed in a storage medium would be one lar ...
s.
The program uses two techniques: a lost file, and a lost drive recovery.
In the lost file recovery technique the program finds deleted file entries, and if requested will do a file carve of selected file types. A variety of popular file types can be found and carved. There is no way to add unknown file types. The file name is found in the deleted file search, but not in the lost file. This is because in most file systems the file name and date/times are stored on disk and are only marked for re-use by the system, and not completely removed.
In the drive recovery technique the program finds orphaned file system entries and reconstructs the missing/lost/corrupted volumes. The user can help the program by selecting file types that may have existed on the old system, but for majority of cases the automatic detection works. The user can also do a file carve in this technique as well. The program will reconstruct the file names and date times if available. This is obtained from non-deleted file system records such as from the NTFS $MFT as discussed here.
The program can be used on physical drives, forensic images, and
RAID
Raid, RAID or Raids may refer to:
Attack
* Raid (military), a sudden attack behind the enemy's lines without the intention of holding ground
* Corporate raid, a type of hostile takeover in business
* Panty raid, a prankish raid by male colleg ...
drives. In the latter case it can also reconstruct the RAID structure.
Files can only be recovered after purchasing a product activation key.
See also
*
List of data recovery software
In computing, data recovery is a process of retrieving deleted, inaccessible, lost, corrupted, damaged, or formatted data from secondary storage, removable media or files, when the data stored in them cannot be accessed in a usual way. The data ...
References
External links
*
Data recovery software
{{storage-software-stub