Data Recovery
For files found in "File View": Recover My Files runs over the disk cluster by cluster. It is looking for the file types that you selected in the list. When, for example, it finds a sector on the disk that looks like a JPEG header, it runs some tests to verify that it is a jpeg header and then continues down the disk looking for the footer. If it finds a valid footer then it runs some more tests to determine if it is a valid file and displays the result. There is not much that can go wrong with this method of finding files which is why files diplayed in "File View" are usually good.
The one thing that the header / footer search is not good at finding is fragmented files - i.e. where files are broken up into c***** and stored in different locations on the disk.
For files found in "Folder View": Each file has on a computer has an MFT record. Recover My Files searches the disk looking for these MFT records. An MFT record for a file contains the name of the file and a "run list". A run list tells Winodws what storage clusters the file data occupies on the disk. For example, a file callled shopping list can have a runlist of 10, 11, 12, 40, 77, 2039 - meaning the file is fragmented (if you were to defragment your hard disk the run list would look like 10,11,12,13,14,15).
When you use programs like partition magic you start to screw with MFT table - so if you have a problem it can have serious results. For example, it is possible that the files that were in one location have been moved, new data now resides in this location, but the MFT records did not get updated to tell the computer where the new data is. Thus, RMF can find the MFT record, but the data that is returned in not valid.
|