Contents
|
A volume is formatted for a special file system, say, FAT or NTFS, and is addressed by a letter (C:, D:, ...). The volume usually covers a continuous area on a physical device (e.g., on a hard disk).
Before read, edit or recovery files and folders you should open the volume where they were located. Depending on the damage you can use one the following methods to open the volume.
If the volume is addressable by a letter (C:, D:, ...), you can open it via the dialog box "Select drive", ( for DOS version);
If the volume has not a letter, first, you should select physical device, where the volume is located, – from the dialog box "Select drive", ( or for DOS). Then open the dialog box "Partitions", select the item "", select the volume from the list (according to the size, the label or its location) and .
If it is impossible to open the volume from the dialog box Partitions", try "NTFS or FAT volumes search" depending on the file system type of the volume, (under Windows NT/2K/XP/Vista, NTFS is the default file system for volumes on hard drivers).
It is possible that more than one volume will be found. The necessary volume may not be the first found. You can open the volume just from the search dialog box. For – NTFS, it is recommended to wait until found files number is enough. For – FAT, you can open the volume as it is found, and then search directory fragments via the menu command.
If the volume opened does not contain the necessary files, you can open search dialog box again and open the next found volume or continue search for volumes if the volume is not found yet or the necessary files are not found (then open the volume again).
If data was moved over the disk, files of one initial volume may belong to different found volumes. Also, the same file may belong to more then one found volumes. Therefore, try to recover files from another volume if they were recovered with errors from one volume.
The additional information on volumes search – "FAT/NTFS volumes search".
Also, the volume may be opened from the Editor Window when viewing the volume boot sector or its copy as "NTFS/FAT/FAT32 Boot sector".
It is also possible to open the volume or entire drive image from the file: Image....
When the new volume is opened the previous volume will be closed.
To find FAT removed and lost folders
use menu command
"search all folders fragments (FAT)"
after the volume is opened;
To view removed and lost NTFS files
go to the folders tree in the files panel.
Before recover files or folders
open the volume
(and read subject).
To recover select the file
Files are recovered from the opened volume
to any available drive,
no changes to the source volume are made.
Warning!
Be sure to recover files on the volume which does not have
any common sectors with the source volume
(it is recommended to recover files to other physical device),
otherwise the data recovered may be overwritten.
The maximum file size for FAT volume is 4 or 2 Gb, so save greater files to the volumes with another files systems.
Menu command .
Open disk/physical device.
-
you can specify parameters and logical disk geometry manually,
(),
(logical geometry is used when search for lost partitions,
255x63 is used almost everywhere for drives greater than 8 Gb).
-
when device is selected the dialog box
"Partitions" will be opened automatically.
Menu command:
Contains partitions list for the base disk (not dynamic).
Boot sectors (and their copy) information is loaded for FAT, FAT32, NTFS files system.
:
show current/saved partitions configuration.
:
show/hide partitions tables.
:
show/hide found boot sectors and tables.
:
when detailed mode is checked the following lines of volume information is shown:
info from table entry ("E"),
info from boot sector ("B"),
info from boot sector copy ("C");
the following information of partition table:
info from table entry referred ("E")
info from the table itself ("T").
When the detailed mode is not checked all the information is displayed in one line.
:
add/remove partition.
:
start FAT volumes search on the selected partition.
:
start NTFS volumes search on the selected partition.
:
open the selected volume.
:
:
open and view partitions configuration saved to file.
:
save to file current partitions configuration.
The only information from partitions tables are saved.
This will allow to fast recover partitions without formatting
when partitions tables is damaged.
It is recommended to save to another physical device.
Before to save, be sure the program understands partitions properly.
:
Partition the drive according to the saved configuration
(command is available when view saved configuration).
The saved partitions tables is wrote to the disk.
Menu commands: .
Search FAT or NTFS volumes.
The special quick search methods allow to find volumes without complete scanning of the selected area. The volumes with the greatest number of files are found at first. You don't have to wait scanning is complete before open a volume found. You can continue scanning from the current state when you open the search dialog box the next time.
There some volumes may be found by mistake (e.g., this can happen if some data was moved over drive). Therefore, it is recommended to define the area allocated by the volume as precisely as possible and scan only this area.
When search FAT volumes the signs "+" in the column "" indicate the precense of the corresponding file system structures (boot sector, clusters table, clusters table copy, root directory). This allows to appreciate the volume damage and the information validness. The column "" indicates the number of directories found which also is usefull to appreciate the validness.
When search NTFS volumes the estimate of the selected volume size is shown. You can see also the number of the found files and total number of volume files (in parentheses there are number of files found, duplicates are included). Before open the volume wait until its first sector number is detected. It is recommended to wait until first sectors numbers are detected for all volumes and all $MFT fragments (which contain sufficiently large number of files found) (the column "") – to avoid wrong adding some files to the volumes.
: open the selected volume.
:
save the scan state to a file.
: load scan state from file
(continue scanning from the saved state is possible).
:
start/stop scanning.
If the scanning area was not changed
the scanning is continue from the last state.
:
select area to scan.
Is is possible to select one of the partitions or any drive extent.
Files panel is accessible after volume is opened.
To show/hide files panel use menu command
.
[Enter], mouse double click –
browse directories, open files data in Editor Window.
Menu command
or keys Ctrl+U – recovery files.
To view removed and found NTFS files go to the folders tree at first.
Important information on editing under Windows.
Editor is for view and edit the selected object. It can be sectors, FAT file, NTFS attibute (e.g., file data), directories.
You can select an object
Use [Esc] key to return to the previous object in the editor window.
Use menu item "View" to select view mode in the editor window.
Use menu item Edit to edit data within the current sector.
Use menu command
To write the editor object or the selected block or sectors
to the file or to another disk use menu command
Open drive or partition image file. Work with image file as usual drive.
The command is for Windows only. It allows to lock volumes and to make them inaccessible for other programs.
If you edit not blocked volume its file system may be damaged if another program is writting to the volume too. Therefore, it is recommended to lock volumes before edit. Under Windows Vista, volume editing is allowable after it is locked.
Close all programs using the volume before locking it. The system volume can not be locked. Never write to the system volume otherwise it will be damaged. It is not possible to lock the volume where the program is placed. Volume can be unlocked after it is closed.
Write object opened in editor/selected block/sectors to a file or to another drive.
It is possible to create drives, partitions, volumes images, to clone drives, to save seclected block, etc.
At first you should select drive containing the source data.
The upper part of the dialog box is for source selecting, the low part is for destination.
When create images take into account that maximum file size on FAT16 volume is 2 Gb, on FAT32 - 4 or 2 Gb.
You can write image drive from the file to the drive, fill drive sectors with file or hex pattern.
First, you should select drive to write to.
Hex pattern maximum size is 8 bytes. For large patterns use file.
:
when selected, file pattern is written repeatedly until
entire are is filled; otherwise file is written once.
:
defines whether to write the next copy of the pattern
to the sector start
(the rest of the previous sector is filled with zeroes)
or to write the next copy just after the previous one and ignore
sectors bounds.
Search for special system stuctures.
Search over all drive sectors beginning from the current sector.
Warning!
Executing this commands on incompatible NTFS system may damage the file system.
Do not use this commands if you see the program does not understand
file system properly or you are not sure.
Never execute the commands on the system volume
(where Windows NT/2K/XP/... system files are located)
otherwise it will be damaged.
Under Windows NT/2K/XP/..., it is recommended to
lock volume before executing commands
in order to disable other programs access to the volume.
After executing the commands you may check the volume
with system program ChkDsk.
It is not recommended to create files names containing
special symbols.
At first open NTFS volume and open the necessary folder of files panel,
Read the warning before use.
At first, select the source file which is to copy to NTFS volume.
Then enter the new file name to create (or modify if exists)
in current folder of the files panel.
You can either overwrite or extend the existing file.
Onyl long file name is being created,
$SECURITY_INFORMATION attribute is not being added.
There is must be enough continuous free space on the volume to extned the file.
Read the warning before use.
Enter the new folder name to create in the current folder
of the files panel.
Only long name will be created,
$SECURITY_INFORMATION attribute won't be added.
Read the warning before use.
Will remove file or folder selected in the files panel.
Read the warning before use.
Files lists of the current folder of
the files panel will be repaired
according to $MFT.
Open object to view/edit in editor window.
Except commands partition tables, physical sectors..., the most of commands require the volume is opened.
Select view mode of editor window.
Use menu item
"encoding" to change
view code table.
Press [Enter] to open file data or directory in the Editor window
(open FAT volume before).
Press [Enter] to go to the corresponding volume cluster.
Press [Enter] to go to the boot sector or the next partitions table.
To select the next file system execute
again (or press F7).
Press [Enter] to open volume.
Press [Enter] to open file data or directory in the Editor window
(open NTFS volume before).
Press [Enter] to open selected attribute or directory in
the Editor window.
Press [Space] to view attribute details.
Edit commands are accessible from
Editor window when view as:
hex,
text,
FAT directory,
FAT16/FAT32,
partitions table,
FAT/FAT32/NTFS boot sector.
Switch to edit/view mode with menu command .
Edit data of one sector, then to drive or changes with menu commands.
Use submenu Tools to perform writes to many sectors.
Before write to the first drive sector switch off BIOS antivirus protection and all programs which perform this protection (like Norton Antivirus, etc.).