View Single Post
  #2 (permalink)  
Old 10-20-2005, 05:37 PM
GDH GDH is offline
Administrator
 
Join Date: Feb 2005
Posts: 2,718
Default Data Recovery

Always a difficult question to answer......

Recover My Files does different types of search. It is best to break this into a search for two different catagories:

1. A Search for "Deleted Files"

The location of files on a Windows PC is tracked by a table called the MFT (Master File Table). When a file is deleted the MFT record for that file is marked to indicate that it is deleted and it is no longer displayed to the user.

When you run a "Fast Search" or a "Fast Format Recovery" or a "Complete Format Recovery" you are telling Recover My Files to scan the MFT, look for deleted files, and display them. The MFT holds the full file and folder name, so all information can be recovered.

2. A Search For Lost Files

However, in many instances the MFT records have become corrupt, overwritten or destroyed. When you run a "Complete Search" the first thing Recover My Files does is a search for "Deleted Files" (see above) and then it moves onto a search for "Lost Files". A lost file search is a sequential scan of the hard drive looking to identify files by their unique file structure - eg. the header and footer of a Word document, the header and footer of a JPEG etc.

So as you can see a "Complete Search" does not rely on MFT records for recovery. This is good because you will still get you files back, but bad because if there is not MFT record the file and folder name is gone (files are returned with with a default name like "Recovered_Word_1.doc").

So in answer to your question - the best search methodolgoy depends on what you have done to your drive.....

"Fast File Search" and "Format Recover" options are good because they get file and folder names back, and using the MFT information you can track the fragmentation of a file.

"Complete File Search" is good because it will find files that no longer have an MFT, but will not give file or folder names and will not give fragmented files.

In OPTIONS/ADVANCED there is also the option to drop the search level for a "lost file" search down from cluster to sector level - this is a very time consuming search, but may find more files as depending on what has taken place on your drive the deleted files may no longer start on cluster boundaries (yes...it starts getting way to complicated).

Hope this helps.
__________________
Graham Henley
GetData Support Staff
http://www.getdata.com
http://www.recovermyfiles.com
Reply With Quote