R-Studio uses a unique
technology when it tries to
recover the data on the area being scanned.
While scanning the selected area, R-Studio reads data directly from the disk,
analyzes them, and tries to determine a record to which the data
belong. The following record types are possible:
·
|
UFS/FFS SuperBlock
record
|
All these record types have different, but known, structure.
Knowing valid values of record fields and relations between them
for each record type, R-Studio
determines a record type for the data. If such record type cannot
be unambiguously determined, the data are assigned to the most
probable record type. The same data can be assigned to several
record types, with a certain probability for each assignment. A
list of possible files is generated from these records.
R-Studio generates a record list
for each record type. This list contains references to records
assigned to a record type from the list with their assignment
probability. The same data can be included into different record
lists. Then R-Studio analyzes
relations between elements in each list and between different
lists, and generates a list of found partitions with their
parameters, such as partition start point and probable size, file
system type, cluster size, and existence probability.
Using the file list and partition list, R-Studio reconstructs file systems and files on
the found partitions. One file can be attributed to several
different partitions.
When the entire disk or its part has been scanned, R-Studio shows all found partitions. Then the
parameters of the found partitions may be manually corrected, if
additional information on them is available.
Using the technology, R-Studio can recover files not only on new and
existing partitions. It also can find and recover data on
partitions that have been deleted or reformatted. If, for example,
there was an NTFS partition, which later was reformatted as a FAT
partition, R-Studio will show two
partitions on the same place on the disk, one having the FAT file
system, the other the NTFS. Then, files found on those partitions
can be recovered.
The technology makes
R-Studio a very powerful data
recovery tool, but it is not omnipotent. As it uses probabilistic
approach to data reconstruction, it cannot guarantee 100% correct
results. Moreover, even if R-Studio
has reconstructed data structure correctly, it is impossible to
guarantee that all found files will be completely and correctly
recovered, as new data may be already written over the old files.
See the Data Recovery Issues
topic for details.
|