
R-Studio Manual167
© 2002...2013 R-Tools Technology Inc.
All these record types have different, but known, structure. Knowing valid values of record fields and relations
between them for each record type, R-Studio determines a record type for the data. If such record type cannot
be unambiguously determined, the data are assigned to the most probable record type. The same data can be
assigned to several record types, with a certain probability for each assignment. A list of possible files is
generated from these records.
R-Studio generates a record list for each record type. This list contains references to records assigned to a
record type from the list with their assignment probability. The same data can be included into different record
lists. Then R-Studio analyzes relations between elements in each list and between different lists, and generates a
list of found partitions with their parameters, such as partition start point and probable size, file system type,
cluster size, and existence probability.
Using the file list and partition list, R-Studio reconstructs file systems and files on the found partitions. One file
can be attributed to several different partitions.
When the entire disk or its part has been scanned, R-Studio shows all found partitions. Then the parameters of
the found partitions may be manually corrected, if additional information on them is available.
Using the IntelligentScan technology, R-Studio can recover files not only on new and existing partitions. It also
can find and recover data on partitions that have been deleted or reformatted. If, for example, there was an
NTFS partition, which later was reformatted as a FAT partition, R-Studio will show two partitions on the same
place on the disk, one having the FAT file system, the other the NTFS. Then, files found on those partitions can
be recovered.
The IntelligentScan technology makes R-Studio a very powerful data recovery tool, but it is not omnipotent.
As it uses probabilistic approach to data reconstruction, it cannot guarantee 100% correct results. Moreover,
even if R-Studio has reconstructed data structure correctly, it is impossible to guarantee that all found files will
be completely and correctly recovered, as new data may be already written over the old files. See the Data
Recovery Issues topic for details.
4.2 Data Recovery Issues
NEVER TRY TO SAVE RECOVERED FILES/FOLDERS TO THE SAME LOGICAL DISK WHERE
THEY RESIDE!!!
Or you may obtain unpredictable results and lose all of your data.
R-Studio writes directly to a hard drive only when writing recovered data and from its hex editor, if writing is
enabled. In all other actions, R-Studio only reads data and analyzes them, and never modifies data on the hard
drives being analyzed.
Most operating systems use lazy-write. So, there is a time lag between file actions and actual changes on data on
a hard drive. R-Studio analyzes data on hard drives only. That is why it does not always detect recent changes
in data structure.
Most operating systems constantly write their service information on hard drives. Such writing is especially
intensive during startup and shutdown procedures. When an operating system deletes a file/folder, it treats the
space where it has resided as empty and may write something in this place. If this happened, the file/folder and its
parameters may be detected correctly, but its data may be lost.
Folder names like $$$Folder58448 on NTFS partitions mean that the folder has not been found on the drive
but some references to it have been. For example, folders My documents, Work, Photos have been found and all
they have one parent folder, whose description has not actually been found on the disk, so its name is unknown
and therefore represented as $$$Folder58448. It may happen that the description of such folders was outside
Komentáře k této Příručce