Introduction

GetDataBack Pro © 2001-2020 by Runtime Software LLC

Phone (USA): +1-888-777-6960, Fax: +1-818-475-1741
Phone (Germany): +49-30-2180 1016
Email: info@runtime.org , Web: http://www.runtime.org

GetDataBack Pro recovers files from Windows, Mac, or Linux drives when the data is no longer accessible due to formatting, partitioning, virus attack, power or software failure, deletion of files.

GetDataBack Pro supports the file systems:
NTFS | exFAT | FAT12,16 | FAT32 | EXT | HFS+ | APFS
Windows | Windows | Windows | Windows | Linux | Apple Mac | Apple Mac

GetDataBack is read-only, meaning the program does not attempt to write to the drive you are about to recover.

Note: If you are going to perform a recovery, DO NOT install this software, or anything else, on the drive you want to recover. Connect the drive containing the lost data as a second drive to a well-prepared machine.

GetDataBack recovers data from:
DRIVE |  | TYPE | REMARKS
 | Hard drive | Physical drive | IDE, SATA, SCSI, any capacity
 | SSD | Physical drive | SATA, internal, any capacity
 | USB Drive | Physical drive | USB, USB-2, USB-3, USB-C, any capacity
 | Floppy | Physical drive | 3.5", 5.25", Zip, Jaz drive, any capacity
 | SD Card | Physical drive | Standard and Micro SD, SDHC, SDXC, Memory Sticks
 | Flash drive | Physical drive | Flash drives, Thumb drives
 | Volume | Logical drive | Volumes or drives represented by letters A:, B:, C:, etc.
 | Image | Image file | Sector-by-sector drive images as created by GetDataBack, DiskExplorer, RAID Reconstructor, Linux DD
 | RAID | Virtual Image file | Virtual Images as created by RAID Reconstructor

GetDataBack Pro runs as a native 64-bit application under 64-bit Windows or as a 32-bit application under 32-bit Windows. The minimal Windows version is Windows Vista.

Do's and Don'ts in Data Recovery

Do not write anything to the drive you want to recover the data from! That includes installing programs, surfing the internet, or even booting from that drive. Instead, attach the drive as a second drive to a working system. Install and run GetDataBack on the healthy system.

Read the page about How to Do a Data Recovery Right.

If you suspect that your drive may have a physical problem or if you get read errors during the scan with GetDataBack, consider making an image of the drive first. If your drive has severe physical problems, we strongly recommend that you refrain from all do-it-yourself data recovery attempts and send the drive to a specialized lab.

Scanning an external drive can be very time consuming, especially when using USB. If possible, remove the drive from its enclosure and attach it directly to your computer's internal SATA cable. Please search the internet for help on how to do this.

If you have any questions about this software, check out our FAQ or contact technical support.

See also: Doing a recovery, FAQ, Checklist, Create Image, Support, License Agreement, License Key

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Installation

***Do not install GetDataBack on the drive you want to recover***

We recommend to proceed as follows:

Install the program on a computer, which does not have any problems. Make sure it fulfills our minimal requirements. Attach the drive you want to recover as a second drive to that machine. Make sure the drive is wired correctly and recognized by the BIOS. Please read our article about doing a data recovery.

After downloading GetDataBack, run the gdbprosetup.exe. The setup wizard guides you through the installation process.

See also: Do a data recovery, Requirements


System Requirements

  • Windows Server 2008, 2012, Vista, Windows 7, Windows 8, Windows 10, 32 or 64-bit
  • 4 GB RAM (depending on the capacity of the drive you want to recover)

Data recovery is a time-critical task, and data recovery software makes intensive use of computational resources. For best results, choose your fastest, most loaded machine and attach the drive you want to recover.

See also: Do a data recovery, Installation


Menu Structure

DRIVE
 | Recover drive | Select drive and begin the recovery
 | Load image... | Load an Image or Virtual Image for data recovery
 | Load previous recovery... | Load a previous data recovery or Recovery Tree
 | Save current recovery... | Save status of current data recovery and Recovery Tree
 | Drive info (drive x) | Show information about the Selected Drive
 | Exit | Quit this program
FILE SYSTEM
 | Mount file system | Select File System and continue the recovery
 | Recovery info | Display details about the current recovery
 | File system info | Display details about the current file system
FILE
 | Info | Display information about the recovery details of a file
 | View | View file with the internal viewer
 | Open | Open file with its native application
 | Copy... | Copy recovered files and directories to a safe destination
 | Rename | Rename a file
 | Search | Quit this program
TOOLS
 | Create image | Create an image of the selected drive
 | Settings | Change program settings
HELP
 | Content | Call the integrated help (this)
 | License | Enter a license key to unleash the full power of this software
 | Snapshot for customer support | Create a snapshot of the recovery for support purposes
 | Print Audit... | Create an Audit file, only visible if Audit is enabled.
 | About | Displays copyright, license and version information

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


License Key

Buying a license key for the software enables you to copy your recovered files and directories. You also get other benefits, such as support and lifetime updates.

Buy online on at http://www.runtime.org/buy_now.htm and get the license key immediately.

Entering the License Key

When entering the license, make sure you enter both the name and the key, exactly as spelled in the registration email we sent. Name and key are a matching pair, and only entering both activates GetDataBack. We recommend you copy and paste the information from the registration email.

See also: Doing a recovery, FAQ, License Agreement


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported, and may be used. By using or licensing Runtime Software software, you agree to these.
This document may be augmented or superseded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assumes responsibility for any expense, damage, or loss caused by your use of this software, howsoever it occurs.
All the registered trademarks used herein are registered to whomever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you buy a license for the software by Runtime Software, we assume that you are doing so, after testing the shareware version and ascertaining that it is suitable for your hardware and requirements. We cannot provide refunds if you subsequently change your mind.

No portion of the documentation for this software or any of its attdendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Licensing this software buys you a named single-user license to use it in perpetuity, subject to the terms discussed herein. With a named single-user license, you are the only user of the license, beiong installed on one computer owned or controlled by you. If you want to have the software installed on more than one computer at the same time, you need to purchase additional licenses. If you want additional users to use the software, you need to purchase additional licenses. A single-user license does not permit you to make the licensed software available over a network for multiple users to access, to distribute it in any form, or to provide it in conjunction with any other product without the express written permission of Runtime Software. The license is not transferable to another party without the written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

A "Technician's License" has the same rights and restrictions as the above "named single-user license", but allows you to perform data recovery services on computers not owned or controlled by you.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free. To use the full version, you have to purchase a license.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet, etc.) as long as you follow each one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software, including the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.

See also: License Key


Glossary

APFS
Apple File System, released in 2017 as a replacement for HFS+
APSB
Volume Superblock in APFS, each representing a different file system state.
Attributes
Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume. See Recovery Tree.
In NTFS, attributes are structures within an MFT record describing a file (see: NT Attributes).
Block
A Block is the smallest unit addressable by the file system, also called a cluster.
Under APFS, a block refers to a unit of file system metadata organized in B-Trees of blocks.
Boot record
A Boot record is a special sector describing the file system following this sector. Boot records are used in all file systems, sometimes called Superblock (APFS, EXT) or Volume Header (HFS+).
Cloning a drive
Making an exact sector-by-sector image of a drive. You may want to do this, if you need to perform a data recovery on a drive that has physical damage (bad sectors). You can work with the image as you would work with the original drive.
Cluster
A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors. In file systems other than NTFS or FAT, clusters are sometimes called blocks
Cluster Size
See Sectors Per Cluster
Data recovery
The process of retrieving files from a drive that cannot be accessed from its operating system anymore.
Deleted file
A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with 0xE5 and releasing the FAT entries of the clusters used. In NTFS, a file is deleted by marking its reference in the MFT as unused. Other file systems, such as EXT and HFS+, remove the allocation information, rendering a deleted file unrecoverable unless it can be recovered through a Journaled File System entry. Check the Deleted checkbox in the Recovery Tree if you want deleted files displayed.

APFS takes a different approach as it creates checkpoints at regular time intervals, preserving all information about deleted files, as long as this information has not been purged. After you click on an APFS file system, GetDataBack prompts you to include old (and possibly deleted) file system states.

Directory
In a FAT file system, a directory is a list of directory entries. In NTFS, a directory is a list of Index Entries. In EXT, a directory is a file containing filenames. HFS+ and APFS organize filenames as B-trees called Catalog
exFAT
Modified FAT32 supporting extents.
EXT
EXT is Linux's Extended File System. There are three variants EXT2, EXT3 (=EXT2 + Journaled FS), and EXT4 (=EXT3 + Extents).
Extents
An extent is a contiguous area of storage reserved for a file in a file system, represented as a range of block numbers. A file can consist of zero or more extents; one file fragment requires one extent. The direct benefit is in storing each range compactly as two numbers, instead of canonically storing every block number in the range. Also, the extent allocation results in less file fragmentation. APFS, HFS+, exFAT, EXT, and NTFS are all using extents to store file allocation. A FAT file system except for exFAT does not.
FAT File System
Name of a file system using a file allocation table. Introduced with DOS for floppies in 1977 and used in all Windows versions. There are FAT12, FAT16, and FAT32, as well as exFAT. The number refers to the length in bits of one FAT entry. So a FAT12 entry is 12 bits long, capable of addressing 2^12=4096 clusters, while FAT32 can, in theory, address 2^32=4294967296 clusters. exFAT is a modified FAT32, using a 32-bit FAT and extents to describe data allocation.
File Entry (MFT entry)
A file entry in NTFS is an entry in the MFT.
File System
The file system (such as FAT or NTFS) is the scheme of how a file is stored on a disk. Do not confuse it with the operating system (such as Windows or Linux).
Hexadecimal
The hexadecimal system is based on the number 16, other than the decimal system, which is based on 10. The supplemental digits are A, B, C, D, E, and F. Example: hex AA = dec 170. (10*16 + 10*1).
HFS+
Hierarchical File System, introduced by Apple in 1998 replacing HFS, now replaced by APFS
Image File
An image file is a sector-by-sector copy of a drive. You can use it as a source for GetDataBack.
Imaging a Drive
See Cloning a Drive
Index Allocation
An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of filenames establishing a directory.
Inode
An inode is a basic structure in EXT. It describes a file and its allocation.
LFN
NTFS uses attributes to store the LFN (long filename).
Logical Drive
Logical drives are drives like A:, B:, C:, etc. They are accessed using the corresponding operation system routines.
Media Descriptor
Flag byte in the boot record and the beginning of a FAT describing the kind of drive. Usually xF8 for hard drives.
MFT (Master File Table)
The MFT is a database containing information about every file or directory on an NTFS volume. An entry is called MFT entry or file entry.
MFT Entry
One 1024-bytes record from the MFT. NTFS file entry
MFT Number
The MFT number is the position of a file entry within the MFT.
Non-resident Attribute
see: NT Attributes
NTFS
File system introduced with Windows NT, used by all current Windows versions.
NT Attributes
The NT Attributes describe every aspect of a file in NTFS, such as filenames, time stamps, file sizes, data allocations and more:
Number | Name | Description
$10 | Standard information | contains time stamps and DOS attributes
$30 | Filename | contains the file's name for different namespaces (usually NT's native Unicode filename and DOS compatible DOS filename)
$80 | Data | if the entry represents a file, this attribute contains the file's data
$90 | Index root | if the entry is a directory, this attribute describes the root of a binary tree of directory entries
$A0 | Index allocation | if the entry is a directory, this attribute contains a list of filenames
NT Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry, while non-resident attributes are store outside using run lists.
Partition
A partition is a contiguous region on a physical drive. The operating system usually interprets it as a logical drive or a volume.
Partition Entry
A partition entry describes the type, location, and size of a partition.
Partition Table
The MBR-style partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive. Size is limited to 2 TB.
A GPT-style partition table is located in sector 1 and does not impose a size limit.
Physical Drive
Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.
RAID
Redundant Array of Inexpensive Disks. Set of drives.
Recovery Tree
Explorer-style view displaying all recovered files and directories. See Recovery Tree, Load and Save Recovery.
Resident Attribute
see: NT Attributes
Root Directory
In NTFS, the root directory is described by the index buffer of MFT entry #5. FAT describes the location and length of the root directory in its boot record. FAT32 and exFAT describe the first cluster of the root in their boot record. EXT defines inode #2 as root.
Run List
A run list is a list of clusters used for an NT Attribute. If the attributes are too large to fit into the MFT entry, some become non-resident, meaning the value part of the specific attribute moves outside of the entry. In this case, the run list describes the outside data.
Scan
A scan is the process of examining every single sector of a drive. See Step1, Load and Save Recovery.
Sector
A sector is the smallest unit you can access on a drive. The size of a sector is usually 512 bytes. Multiple sectors are grouped into clusters. On drives that employ the 4K-sector-hack, the sector size is 4096 bytes, see Bytes per sector.
Sectors Per Cluster
This term describes the cluster size the file system is using. It is fundamental for translating a cluster number into a physical sector number.
Sophistication Level
The Sophistication Level is a unique feature of GetDataBack to balance the need to collect relevant information against the time it takes to do that. The concept allows for a measured approach to a drive. It is our goal to scan the "bad drive" for what is needed for the data recovery to work, while ignoring uninteresting or unpromising areas on the drive.
Superblock
A Superblock is a special sector describing the file system following this sector, especially in EXT and APFS. See Boot records
Virtual Image
Virtual Images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. That is especially helpful if you want to recover RAID arrays.
Volume
A Volume is a logical drive, usually defined by a partition on a physical drive
Volume Header
A Volume Header is a special sector describing the file system following this sector, especially in HFS+. See Boot records
<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Prepare a Recovery

Doing a Data Recovery

Typical Data Recovery Scenario

  1. Install GetDataBack on a healthy Windows machine without the drive attached that you want to recover data from ("bad drive").

  2. Make sure you have sufficient space on the "good drive" for storing the recovered data. You also can copy the recovered data to a LAN if you have access to one. The machine you are running GetDataBack on can have any of the following operating systems: Vista, Windows 7, Windows 8, Windows 10, 32-bit or 64-bit.

  3. Shut down the computer and attach the drive you want to recover from ("bad drive") as a 2nd drive. If it is an internal drive, attach it to the internal SATA cable and make sure it is recognized correctly by the BIOS when starting up the computer. If it is a USB drive, start up the computer and attach it to a USB port. Make sure the USB device is recognized, and the drive shows up in Windows Disk Management.

  4. Start GetDataBack and verify that DISK0: is the "good drive" and DISK1: is the "bad drive".

  5. In the Select Drive screen, select the "bad drive" DISK1.

  6. In the Select File System screen, select the matching file system.

  7. Once you see the Recovery Tree and are ready to copy the recovered files over to the "good drive", you need to purchase a license key, if you have not already done so. Do not quit GetDataBack for purchasing or entering the license code; just enter the code and continue with copying the files. It is a good idea to start with the files you need most.

  8. After copying all desired files, shut down the computer and remove the "bad drive". Store the "bad drive" in a safe place.

  9. We suggest to build a brand new system now. Use components other than the "bad drive". Install the operating system. Install the programs from their installation CD-ROMs. Finally, import the recovered data to the new drive.

  10. Verify you got back all the data you need. Do not recycle the "bad drive" before you are sure about this. It is a good idea to wait 4 weeks before re-using the "bad drive". If the "bad drive" had any mechanical problems, you definitely should not use it again.

Drive Errors

If you notice any mechanical problems during the recovery with the drive, such as bad sectors or unusual noise, you might want to make an image of the drive first. When successfully created, you can recover from this drive image as you would recover from the original drive. A mechanically damaged drive can fail any second, and you should pull the data off such a drive as fast as possible. Making an image can reduce the load on the drive, because this reads each sector only once.

On the other hand, scanning the drive with a low sophistication level might leave broad areas untouched, thus actually reducing the stress compared to creating an image. That holds especially true if you are looking to recover only a couple of files. Please read our discussion on this topic. In the end, this is your data and your call. You might also consider to stop the recovery attempt altogether and ship the drive to a lab.

Modified Procedures

If you divert from the process described above, always make sure you

  • never install GetDataBack on the "bad drive",
  • never use the "bad drive" as the boot-up system drive (C:),
  • do not have temporary files and directories use the "bad drive",
  • never copy the recovered files to the "bad drive".

If you do not have a working Windows or need to recover a drive in a laptop, you can create a WinPE boot medium.

See also: Snapshot, FAQ, Checklist, Create Image, Read errors, WinPE


Select Drive

Physical Drives

GetDataBack's first screen lists all available physical drives along with their characteristics.

Click on the drive you want to recover the lost data from. Red tiles represent physical drives. Each tile contains information about the drive, such as name and capacity. Typically, you would click on the second tile labeled DISK1.

Images and Virtual Images

You can also load an image file (.img) you had previously created. Click on the yellow tile and navigate to the image file. Once you click Open, the image is added as a yellow tile to the existing tiles. You can now select the image in the same way you would select a physical drive. You can also open virtual images (.vim), for example, representing a RAID array that you created previously with RAID Reconstructor.

Logical Drives

Usually, physical drives, images, or virtual images are all you need. If you wish to add logical drives (C:, D:, etc.) to the screen, you can do so by going to TOOLS->Settings->Miscellaneous and check Show logical drives. This checkbox adds a blue tile to the screen. Clicking on it adds all compatible logical drives as blue tiles. The second screenshot on the right side shows red tiles for physical drives, blue tiles for logical drives, and yellow tiles for images and virtual images.

Drive Info

Right-clicking a tile and selecting Drive info, or going to DRIVE->Drive info (Drive) displays valuable information about a particular drive.

Start the Recovery

After clicking on the drive you want to recover, or going to DRIVE->Recover drive->(drive), GetDataBack immediately begins its analysis, looking for file systems on the selected drive. GetDataBack knows 4 distinctive sophistication levels and automatically picks the appropriate level. Should the need arise, you can set the minimum level in TOOLS->Settings->Data Recovery->Data recovery->Initial level. Once the recovery process started, you can watch its course in the progress window. In the example above, we clicked on the 17 GB Virtual Image raid.vim.

The scan should take a couple of seconds up to a couple of minutes. If it takes significantly longer, there are three possible reasons:

  1. Your drive has physical problems. If the drive has a lot of bad sectors (damaged areas on the drive's platters that cannot be read anymore) or is otherwise damaged, the scan can take a long time if it is ever going to finish.
    If you get only an occasional bad sector message, but the scan is otherwise progressing, choose "Ignore" in the warning windows and let the scan finish.
    If you receive many read error messages, though, or the scan seems to stall or is taking forever, your best bet is to stop what you are doing and to make an image of your damaged drive first. By making an image, you reduce the stress on the drive (which, if physically damaged, can fail at any moment). Once you have created the image, you can perform the data recovery for the image instead of the drive - select the image you made in the Select drive screen (click on “Image Files...”). You can use GetDataBack to make an image; the only other thing you'll need is enough space on another drive to store the image.
  2. You are scanning an external drive through the USB port. Scanning a drive through USB takes longer than scanning a drive connected to the internal SATA cable of your computer. Consider taking the drive out of its casing and attaching it directly to the SATA cable.
  3. You are scanning with a high sophistication level. Look at the purple rectangle in the lower-left corner. A Level-4 (****) scan takes many hours to complete, as it reads every sector, which is usually not necessary for a quality recovery.

Load a Previous Recovery

GetDataBack's first screen is also the place where you would load a recovery you previously ran.

Create an Image of the Drive

At this point, you can create an image of a drive if you like. An image is a good idea, especially if a drive has bad sectors.

Change Settings

If you want to run GetDataBack with settings other than the default settings, you can do so in TOOLS->Settings. For example, you could limit the types of file systems to look for or change the sophistication level.

Status Line Information

At any given time, the status line contains information about GetDataBack's current status, memory consumption, etc.

See also: Drives, Scanning the drive, Create Image, Load recovery, Sophistication level

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Drives

GetDataBack accepts four types of drives. In the Select Drive screen, each type can be selected as a drive for GetDataBack to perform the data recovery on.

TYPE | DRIVES | REMARKS

Physical drive

 Hard drive IDE, SATA, SCSI, any capacity
SSD | SATA, internal, any capacity
USB Drive | USB, USB-2, USB-3, USB-C, any capacity
Floppy | 3.5", 5.25", Zip, Jaz drive, any capacity
SD Card | Standard and Micro SD, SDHC, SDXC, Memory Sticks
Flash drive | Flash drives, Thumb drives

Logical drives

 Volume Volumes or drives represented by letters A:, B:, C:, etc.

Image files

 Image Sector-by-sector drive images as created by GetDataBack, DiskExplorer, RAID Reconstructor, Linux DD

Virtual Image files

 RAID Virtual Images as created by RAID Reconstructor

See also: Physical drive, Logical drive, Image, Virtual Image


Physical Drives

Physical drives are tangible media, such as:

DRIVES |  | REMARKS
 | Hard drive | IDE, SATA, SCSI, any capacity
 | SSD | SATA, internal, any capacity
 | USB Drive | USB, USB-2, USB-3, USB-C, any capacity
 | Floppy | 3.5", 5.25", Zip, Jaz drive, any capacity
 | SD Card | Standard and Micro SD, SDHC, SDXC, Memory Sticks
 | Flash drive | Flash drives, Thumb drives

They have specific names:

Name | Alternate Name*) | Description
DISK0 | HD128 | 1st physical drive
DISK1 | HD129 | 2nd physical drive
: | : | more physical drives
FD0 |  | 1st diskette drive
FD1 |  | 2nd diskette drive
*) The alternate drive names HD128, HD129, etc. originate from the BIOS interrupt 13h in the early days of computing. The number of the first drive was 128, therefore the name HD128. Other programs from Runtime Software still use the alternate notation. Virtual Images in GetDataBack also do.

These drives are all shown in GetDataBack's first screen, Select Drive. If a drive is not shown, check its cabling, or try on a different machine.

If a physical drive is reporting read errors, consider to stop working with the corrupted drive until you make a disk image. (Every try to access data can increase corruption) After successfully creating an image, you can use the image file as an input for GetDataBack.

See also: Drives, Logical drive, Image, Virtual Image, Create image


Logical drives

Logical drives are volumes known to the operating system as A:, B:, C: etc. Typically, you should not select a logical drive for recovery, but the underlying physical drive. The logical drive is an additional layer between GetDataBack and the data that we do not need.

One exception might be a mounted encrypted drive that you want to access, and that only provides transparent access through its drive letter.

If, in particular circumstances, you wish to add logical drives (C:, D:, etc.) to the Select Drive screen, you can do so by going to TOOLS->Settings->Miscellaneous and check Show logical drives. That adds a blue tile to the screen. Click on it, and all compatible logical drives appear as blue tiles. The screenshot on the right side shows red tiles for physical drives, blue tiles for logical drives, and yellow tiles for images and virtual images.

Even if they have a drive letter, there are logical drives that you can not select for recovery, for example, CD drives, network drives, or NAS drives.

See also: Drives, Physical drive


Image Files

Image files are files containing a raw sector-by-sector image of a drive. You can recover from an image file in the same way you can from a physical drive. Click the yellow tile Image files... in the Select Drive screen to open an image file as a drive.

Image files have the extension ".img". Compressed images have the extension ".imc".

Clone an Entire Drive

You can create image files using the TOOLS->Create image command. You may use the image file instead of the original drive. You also can use image files created with other software, such as Runtime's DiskExplorer or RAID Reconstructor, or the Linux DD command.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. drive128.img, drive128.001, drive128.002, ..., drive128.999, drive128.a00, drive128.a01, ...)

Multiple files are helpful when you image to a drive with limited file size, e.g., FAT32. Segments of a multiple file image are about 656MB in size. A smaller size indicates the end of the image set.

See also: Create image file, Drives, Physical drive, Logical drive, Virtual Image


Virtual images

Virtual Image

Virtual Images are short text files describing the data to be loaded. Thus, you can glue together different data sources. This is especially helpful if you want to recover RAID arrays. RAID Reconstructor creates virtual images that you can use in Runtime's Captain Nemo, GetDataBack, or DiskExplorer.

Virtual images always have the extension "vim".

You can also create your own virtual images. Virtual images are XML files with just a couple of commands ("tags"). You can put together any number of drives.

<virtualimage>

This is the root tag that encloses all other tags.

Example:

    <virtualimage>
    :
    :(other tags)
    :
    </virtualimage>

<sector>

This tag sets the sector number of the virtual image to a new value. Any gaps you create by that will be filled with 0's.

Example:

    <virtualimage>
    :
        <sector>1000</sector>
    :
    </virtualimage>

<drive>

This tag describes a drive that is being used. You can also specify a certain area inside that drive.

NOTE: Physical drives DISK0, DISK1, etc., are described using the legacy notation HD128, HD129, etc.

Example:

    <virtualimage>
        <drive>HD128:</drive>
    </virtualimage>

This example of a virtual image uses your first hard drive (HD128:). Make sure you always append a colon to the drive's name.

Another example:

    <virtualimage>
        <drive>HD128:0-999</drive>
        <drive>c:\images\myimage.img:1000-</drive>
    </virtualimage>

This example maps the first 1000 sectors of HD128 to your virtual image. Sector 1000 and up of your virtual image is sourced from sector 1000 and up of the image file "c:\images\myimage.img". The ranges are specified by appending two numbers, separated by a dash. The range extends to the end of the respective drive if you leave out the second number.

Example with a NULL drive:

    <virtualimage>
        <drive>NULL:0-8000000000</drive>
    </virtualimage>

This defines a drive with 4 TB that you can open with Captain Nemo, GetDataBack, or DiskExplorer.

NULL drive example with labeled and numbered sectors:

    <virtualimage>
        <drive>NULL(Sector Number):0-8000000000</drive>
    </virtualimage>

This creates a virtual 4 TB drive with numbered sector numbers. Look at how sector 4711 would look like:

This is a useful feature for research purposes. When experimenting with RAID fragments, you can see where a sector originated.

Possible drive names are:

HD128:, HD129:, etc. | DISK0 (1st physical drive), DISK1 (2nd physical drive), etc.
FD0:, FD1: | 1st, 2nd floppy drive
C:, D:, etc. | Logical volume C:, D:, etc.
myfile.img, myfile.imc | Image files
NULL: | Virtual drive, delivers empty sectors. It must be followed by a range.
NULL(LABEL): | Virtual drive, delivers labeled and numbered sectors. A range must follow it.

<loop>

Use the <loop> tag to define RAID arrays.

Example definition of a 3 drive RAID-5 with a block size of 128, backward rotation:

    <virtualimage>
        <loop>
            <drive>c:\img\raid5\r1.img:</drive>
            <drive>c:\img\raid5\r2.img:</drive>
            <drive>c:\img\raid5\r3.img:</drive>
            <cycle blocksize="128">
                <stripe>1,2</stripe>
                <stripe>1,3</stripe>
                <stripe>2,3</stripe>
            </cycle>
        </loop>
    </virtualimage>

After the <loop> tag, specify the drives you use in the RAID. On the syntax of the <drive> tag, see the specification above.

<cycle>

In the <cycle> tag, define the stripes making up the RAID. Each stripe is a sequence of data taken from the previously defined drives. Define the block size as an attribute for the <cycle> tag. You would read the example above as:

  1. Take 128 sectors from the 1st drive (sectors 0-127).

  2. Take 128 sectors from the 2nd drive (sectors 0-127).

  3. Take 128 sectors from the 1st drive (sectors 128-255).

  4. Take 128 sectors from the 3rd drive (sectors 128-255).

  5. Take 128 sectors from the 2nd drive (sectors 256-383).

  6. Take 128 sectors from the 3rd drive (sectors 256-383).

That continues until the end of one drive has been reached. The smallest drive determines the size of the loop. If the smallest drive is 10,000 sectors, the total size is 20,000 rounded up to a full cycle, which is 20,736. You can change the size of the loop in two ways:

1) Specify the number of times the loop should be repeated. You can do this by adding an attribute with the name "repeat" to the <loop> tag, e.g.: <loop repeat="27">. In the RAID example, repeating the cycle 27 times yields 6*128*27 sectors, which is 20,736.

2) Specify a range. Do this by adding the attribute "range" to the <loop> tag, e.g.: <loop range="10-20".

The "repeat" takes precedence over the implicit size as determined by the drives. The "range" takes precedence over the "repeat".

You can even define incomplete RAID-5 arrays. If, in the example above, the 3rd drive would be missing, you could describe the array like that:

    <virtualimage>
        <loop>
            <drive>c:\img\raid5\r1.img:</drive>
            <drive>c:\img\raid5\r2.img:</drive>
            <cycle blocksize="128">
                <stripe>1,2</stripe>
                <stripe>1,1x2</stripe>
                <stripe>2,1x2</stripe>
            </cycle>
        </loop>
    </virtualimage>

The expression 1x2 will calculate the missing sector, originally on the 3rd drive.

The <stripe> tag can have a "repeat" attribute, e.g.

    <stripe repeat="16">1,2</stripe>

This will cause a repeat of the <stripe> tag sixteen times.

<searchbootranges>

This tag does not change the Virtual Image. It is only information for programs using the VIM file, such as Captain Nemo.

For example,

    <searchbootranges>64200-64300;8450200-8450300;12643200-12643300</searchbootranges>

will instruct Captain Nemo to look for boot records at the sectors indicated.

See also: Drives, Image files


Drive Details

Right-click a tile in Select Drive to examine detailed information about that drive. The details are different for every drive type.

Quick jump to: Physical drive, Logical drive, Image, Virtual Image

Physical Drive Details
Name Example Value Description
Tile:
DISK0 (954 GB)
SAMSUNG MZFLW1T0HMLH-000MV
Physical drive DISK0 with 954 GB, Model "SAMSUNG MZFLW1T0HMLH-000MV"
Drive name: DISK0 First HD
Size: 954 GB Capacity
Type: Physical hard drive Drive type
Sectors: 2,000,409,264 # sectors on drive
CRC32 boot: 972345893 Checksum of sector 0
Hash: 7954ba888e34309a
25603134bc4a5ec9 		Hash of sector 0
Bytes per sector: 512 Physical bytes per sector (512 or 4096)
NOTE: This value can be changed, for example, if you need to recover from a drive that uses the 4K-sector-hack to address the space beyond 2 TB. GetDataBack tries to adjust to those drives automatically but might need this setting, especially if the drive is no longer accessed through its original USB enclosure, or if you are recovering from an image of that drive.
Read/write errors: 0 Total read or write errors
Tot secs read: 5525451 (0%) Total number of sectors read since opening drive
Tot secs fail: 0 (0%) Total number of sectors read fails since opening drive
Drive model: SAMSUNG MZFLW1T0HMLH-000MV Name reported by drive
Drive serial: 0025_38B3_61B0_0AB0 Serial number reported by drive
Disk ID: FFFFFFFF Disk ID reported by Windows
Partitions:
Partition: 1st GPT partition (EFI System partition) 260 MB
Sector: 2,048 (532,480) Origin and length of partition
Mapping: DISK0#1 => (none) Mapping to drive letter
Drive letter: (none) Drive letter
Hash: b8f741737c92be57
651678387476c8ff 		Hash of first sector of partition
Partition: 2nd GPT partition (Windows - Microsoft Reserved Partition) 128 MB
Sector: 534,528 (262,144) Origin and length of partition
Mapping: DISK0#2 => (none) Mapping to drive letter
Drive letter: (none) Drive letter
Hash: bf619eac0cdf3f68
d496ea9344137e8b 		Hash of first sector of partition
Partition: 3rd GPT partition (NTFS) 953 GB
Sector: 796,672 (1,997,932,544) Origin and length of partition
Mapping: DISK0#3 => C: Mapping to drive letter
Drive letter: C: Drive letter
NOTE: This is the only partition that is actually mapped to a letter
Hash: de14906704f8f453
d38dc06f274f5069 		Hash of first sector of partition
NOTE: this hash matches logical drive C: below
Partition: 4th GPT partition (Windows - Windows Recovery Environment) 820 MB
Sector: 1,998,729,216 (1,679,360) Origin and length of partition
Mapping: DISK0#4 => (none) Mapping to drive letter
Drive letter: (none) Drive letter
Hash: ef448b4e1ed58289
605a37662f5cdf1f 		Hash of first sector of partition

Logical Drive Details
Name Example Value Description
Tile:
C: (953 GB)
Windows
Logical drive C: (Windows) with 953 GB
Drive name: C: (953 GB) Drive C:
Type: Logical hard drive Logical hard drive or Removable drive
Sectors: 1,997,932,536 Total sectors in volume
CRC32 boot: 1475666258 Checksum of sector 0 of volume
Hash: de14906704f8f453
d38dc06f274f5069 		Hash of sector 0 of volume
NOTE: this hash matches DISK0#3 above
Bytes per sector: 512
Read/write errors: 0 Total read or write errors
Tot secs read: 5463334 (0%) Total number of sectors read since opening drive
Tot secs fail: 0 (0%) Total number of sectors read fails since opening drive
Volume label: Windows Log. drive volume label
Serial number: 3870B62A Log drive serial number
File system: NTFS NTFS, EXFAT, FAT32, or FAT
Sectors/Cluster: 8 Cluster size in sectors
Max filename length: 255 Max filename length
Physical location: DISK0#3 Physical drive and partition of volume
Total free sectors: 192,274,232 Free space
% Used: 90%
NTFS specific
Sectors in volume: 1,997,932,543 Total sectors in volume
MFT cluster: 786,432 $MFT cluster number
MFT mirr cluster: 2 $MFTMirr cluster number
MFT size: 1024 Size of one MFT record (usually 1024)
INDX size: 4096 Size of one INDEX record (usually 4096)
Information about the physical drive containing this logical drive
Physical drive name: DISK0 Containing physical drive
Physical partition#: 3 Partition number in containing physical drive
Physical offset: 796,672 Sector offset of partition in containing drive
Physical sectors: 1,997,932,544 Length of partition in containing drive
Physical capacity: 2,000,409,264 Capacity of containing drive
Physical IDE name: SAMSUNG MZFLW1T0HMLH-000MV
Mapping: DISK0#3 sector 796,672 (1,997,932,544 sectors)
NOTE: this is partition #3 in the physical drive above

Image Details
Name Example Value Description
Tile:
ex183gb.imc (183 GB)
Image C:\img\exfat\ex183gb.imc with 183 GB
Drive name: C:\img\exfat\ex183gb.imc Image drive (compressed)
Size: 183 GB Capacity
Type: Image file Compressed image file
Sectors: 384,503,808 # sectors on drive
CRC32 boot: 2079715874 Checksum of sector 0
Hash: b728991e8d214414
97f4a19647a28552 		Hash of sector 0
Bytes per sector: 512 Physical bytes per sector (512 or 4096)
NOTE: This value can be changed, for example, if you need to recover from a drive that uses the 4K-sector-hack to address the space beyond 2 TB. GetDataBack tries to automatically adjust to those drives, but might need this setting, especially if the drive is not longer accessed through its original USB enclosure, or if you are recovering from an image of that drive.
Read/write errors: 0 Total read or write errors
Tot secs read: 939047 (0%) Total number of sectors read since opening drive
Tot secs fail: 0 (0%) Total number of sectors read fails since opening drive
Multi: True This is a multi-segment image. It consists of segments wth 656MB each.
Open mode: read-write
Compressed: True The image is compressed
Compression engine: 1 0=Legacy, 1=Fast, 2=Good (slow)
Compression details: 6007872 chunks, 5858081 sparse, 9903 compressed "Chunks" are compression units of 64 sectors. "Sparse" are null sectors.
Segments: 7 Number of segments in this multi-part image
Segment 0: C:\img\exfat\ex183gb.imc, 1,344,000 sectors Name and size of first segment
Segment 1: C:\img\exfat\ex183gb.001, 1,344,000 sectors Name and size of second segment
Segment 2: C:\img\exfat\ex183gb.002, 1,344,000 sectors Name and size of third segment
Segment 3: C:\img\exfat\ex183gb.003, 1,344,000 sectors Name and size of fourth segment
Segment 4: C:\img\exfat\ex183gb.004, 1,344,000 sectors Name and size of fifth segment
Segment 5: C:\img\exfat\ex183gb.005, 1,344,000 sectors Name and size of sixth segment
Segment 6: C:\img\exfat\ex183gb.006, 1,123,384 sectors Name and size of seventh segment
NOTE: The last segment is always smaller, signaling GetDataBack that the last segment has been reached.
Partitions:
Partition: 1st partition (NTFS) 183 GB
Sector: 32,768 (384,471,040) Origin and length of partition
Mapping: C:\img\exfat\ex183gb.imc#1 => (none) Mapping to drive letter
NOTE: always none, because an image can not be mapped to a drive letter.
Drive letter: (none) Drive letter
Hash: 1eff0688b32c20af
937766fede385b6b 		Hash of first sector of partition

Virtual Image Details
Name Example Value Description
Tile:
raid.vim (9.54 GB)
Virtual Image C:\img\raid.vim with 9.54 GB. This file contains the following XML code, describing a 3-drive RAID-5 with backward rotation and a blocksize of 128:
RAID.VIM
<virtualimage>
<loop>
  <drive>C:\img\drive1.img:</drive>
  <drive>C:\img\drive2.img:</drive>
  <drive>C:\img\drive3.img:</drive>
  <cycle blocksize="128">
    <stripe>1,2</stripe>
    <stripe>1,3</stripe>
    <stripe>2,3</stripe>
  </cycle>
</loop>
</virtualimage>
Drive name: C:\img\raid.vim Virtual Image File
Size: 9.54 GB Capacity
Type: Virtual Image
Sectors: 20,000,256 # sectors on drive
CRC32 boot: 972345893 Checksum of sector 0
Hash: 7954ba888e34309a
25603134bc4a5ec9 		Hash of sector 0
Bytes per sector: 512 NOTE: Physical bytes per sector (512 or 4096)
This value can be changed, for example, if you need to recover from a drive that uses the 4K-sector-hack to address the space beyond 2 TB. GetDataBack tries to automatically adjust to those drives, but might need this setting, especially if the drive is not longer accessed through its original USB enclosure, or if you are recovering from an image of that drive.
Read/write errors: 0 Total read or write errors
Tot secs read: 150603 (1%) Total number of sectors read since opening drive
Tot secs fail: 0 (0%) Total number of sectors read fails since opening drive
VIM: 1 items This is a VIM file with one item representing the RAID loop:
Item 0: 0-20,000,255 read from LOOP(26042,128,(C:\img\drive1.img:0-9999999),(C:\img\drive2.img:0-9999999),(C:\img\drive3.img:0-9999999),(1,2),(1,3),(2,3))0-20,000,255 (20,000,256 sectors)
Partitions:
Partition: 1st GPT partition (EFI System partition) 260 MB
Sector: 2,048 (532,480) Origin and length of partition
Mapping: DISK0#1 => (none) Mapping to drive letter
NOTE: always none, because an image can not be mapped to a drive letter.
Drive letter: (none) Drive letter
Hash: b8f741737c92be57
651678387476c8ff 		Hash of first sector of partition
Partition: 2nd GPT partition (Windows - Microsoft Reserved Partition) 128 MB
Sector: 534,528 (262,144) Origin and length of partition
Mapping: DISK0#2 => (none) Mapping to drive letter
Drive letter: (none) Drive letter
Hash: bf619eac0cdf3f68
d496ea9344137e8b 		Hash of first sector of partition

See also: Drives, Physical drive, Logical drive, Image, Virtual Image, Checklist, File system details, File details, Recovery Info


Scanning for File Systems

The progress window shows information about the ongoing recovery process. At this point, GetDataBack is searching for file systems on your drive, and the recovery is between the Select Drive and the Select File System screen.

You can see:

  • Current level (L3)
  • Current process (L3: Searching for NTFS, ...),
  • The drive being scanned (DISK0)
  • Number of already identified files (12467 starts)
  • Identified directories (61s381c0xr0xs17xc):
    61s | 61 FAT directory starts
    381c | 381 FAT dir continuations
    0xr | 0 exFAT root
    0xs | 0 exFAT dir starts
    17xc | 17 exFAT dir conts
  • MFT entries (148048, 4 $MFT)
  • Boot sectors found (6 NT, 0 16, 4 32, 0 EX, 0 E, 1 H+, 0 NX)
    6 NT | 6 NTFS boot records
    0 16 | 0 FAT boot records
    4 32 | 4 FAT32 boot records
    0 EX | 0 exFAT boot records
    0 E | 0 EXT superblocks
    1 H+ | 1 HFS+ volume header
    0 NX | 0 APFS superblocks
  • Number of NTFS Index allocations (7426)
  • Number of APFS nodes (3A33 blocks)
  • Number of HFS+ nodes (0 headers, 466 ends)
  • Number FAT tables found (0 12, 0 16, 2 32, 2 EX)
    0 12 | 0 FAT12 tables
    0 16 | 0 FAT16 tables
    2 32 | 2 FAT32 tables
    2 EX | 2 exFAT tables
  • Scrolling detail window with filenames from found MFT records
  • Sector which is currently examined (7,384,141)
  • Remaining time the scan will take and a progress bar indicating the percentage of the drive already scanned

Press Escape or click Stop if you want to cancel this process. You can choose:

  • Cancel this recovery
    Go back to previous screen
  • Continue this recovery
    Recommended
  • Interrupt the scan but continue
    Perform the recovery with what was found yet

Selecting the first option brings you back to the Select Drive screen. The second option resumes the recovery. If you choose the last option, GetDataBack continues the recovery with the information it has collected so far, but ends the search for file systems.


Select File System

File System List

You see a list of the possible file systems GetDataBack has found on the left-hand side of the screen. Don't confuse the file system entries with the list of files and directories you are hoping to recover - you see those in the next step of the software.

Each tile (red in this example) represents a (possible) partition on the drive. If you had more than one partition on the drive you need to recover (for example, logical drives C:\ and D:\), you probably have to go back and forth and select the corresponding entries separately to recover all files.

If there are no entries at all, or entries are missing, there are four possible reasons:

  1. Your drive is physically damaged, and GetDataBack cannot read enough sectors on the drive to gather the required information. If you were getting many read error messages during the scan or already know that your drive has a physical problem, it might be too damaged for you to recover your data with software. You might have to send your drive to a data recovery lab. Please contact our technical support - they can help you determine if this is the case.
  2. You are scanning an external drive through USB. Since there is only limited error checking when scanning through USB, possible errors while reading the drive are not reported to GetDataBack. It can then happen that the software is unable to collect enough information to come up with a file system entry. It is best (and much quicker) to attach the drive directly to the internal SATA cable.
  3. The drive is hardware encrypted, as it is the case with some Western Digital USB drives. Encryption and decryption are handled by the USB controller of the drive's enclosure. If this is the case, you must use the drive with its original USB enclosure.
  4. The sophistication level was too low. If you do not see an entry resembling the file system you are looking for, click on the purple “Level” rectangle in the lower-left corner. Here you can increase the thoroughness with which the drive is scanned. Possible are levels * up to ****

Interpreting Individual Tiles

GetDataBack generates the file system entries using the information it has collected during the scan. By default, the most accurate file system entry is automatically on top of the list. In the example to the left, GetDataBack found two NTFS partitions, one with 14.9 GB and one with 2 GB. The third line of information in each tile indicates the size and position of that partition relative to the containing drive. As we had chosen the 17 GB drive in the first step, you can read the tiles like this:

  • 14.9 GB NTFS partition covering 88% of the 17 GB drive and beginning at 11%
  • 2 GB NTFS partition covering 11% of the 17 GB drive and beginning at 0% (start of drive)

    • We see, there is a 2 GB partition, followed by a 14.9 GB partition. In its list, GetDataBack gives preference to the larger one.

    Sometimes the file system list can contain a confusing number of entries. If the first entry does not produce what you are looking for, you need to examine the entries in greater detail. Look for a file system that comes closest to the type, size, and position of the partition you lost. If the desired file system is not in the list, try to increase the sophistication level by clicking on the purple tile in the left bottom corner.

    Supported File Systems

    NTFS | exFAT | FAT12,16 | FAT32 | EXT | HFS+ | APFS
Windows | Windows | Windows | Windows | Linux | Apple Mac | Apple Mac

    More File System Information

    Right-click a file system tile or click on FILE SYSTEM->File system info (file system) to obtain a detailed description of the found file system. Our tech support staff primarily uses this information.

    Recovery Information

    As soon as a recovery has begun, you can view the recovery info by clicking on FILE SYSTEM->Recovery info.

    Start Building the Recovery Tree

    In our example, we click on the first entry in the list. GetDataBack now begins collecting files and directories for the Recovery Tree. You can follow the progress in the progress window.

    This operation can take a couple of seconds, up to many hours, so you need to be patient. Do not stop this process unless you have to.

    If the selected file system is an APFS, the program prompts you to include old file system states.

    Navigation

    Use the small left and right arrows in the top left corner for going back and forth between the screens. Pressing the left arrow brings you back to the Select Drive screen. Press the right arrow, and you move forward to the next screen. You can navigate between the screens without losing the progress. If a process needs to unload a current recovery, it warns you beforehand.

    Save the Recovery

    At this point, you can save the recovery as it has progressed until now and continue later.

    Sophistication Level

    The purple tile in the left bottom shows the current sophistication level. Possible values are 1 (*) to 4 (****). The higher the level, the more file systems GetDataBack might find. You can increase the level by clicking on the purple tile. If you change the level, it is effective going forward. At the same time, the already completed scan between the Select Drive screen and this screen is elevated to the higher level by repeating the scan with the increased level.

    See also: Scan, Save recovery, Recovery info, Sophistication level, File System Details, Checklist

    << Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Sophistication Level

The Sophistication Level is a unique feature of GetDataBack to balance the need to collect relevant information against the time it takes to do that. The concept allows for a measured approach to a drive. It is our goal to scan the "bad drive" for what is needed for the data recovery to work, while ignoring uninteresting or unpromising areas on the drive.

List of Areas of Interest

There are four distinct levels. Level 1 provides the fastest scan, while level 4 does a complete scan of the drive. For any level other than 4, GetDataBack generates a list of areas of interest (LAI).

The LAI includes:

  • Sectors 0, 63, 2048, 264192
  • Sectors 0+8*0xC0000, 63+8*0xC0000, 2048+8*0xC0000, 264192+8*0xC0000
  • Sectors 0xC0000, 2*0xC0000, 3*0xC0000, 4*0xC0000
  • Partition starts per partition table (ps), ps+0xC0000, ps+2*0xC0000, ps+4*0xC0000, ps+8*0xC0000
  • Last sector of drive
  • Sector numbers listed in TOOLS->Settings->File Systems->Boot sectors->Search ranges, by default 0-100000
  • As well as other special tweaks
  • Once the above sectors have been added, GetDataBack extends the list by a Bracket. For each included sector number, the sector numbers for Sec to Sec+Bracket, and in some cases Sec-Bracket to Sec, are included as well.
    Once the above sectors have been added, the list is extended by a Bracket. This means, for each included sector number, the sector numbers for Sec to Sec+Bracket, and in some cases Sec-Bracket to Sec, will be included as well.

Streaks and Thieves

GetDataBack's smart scan algorithm looks for Streaks and continues scanning adjacent sectors if structures of interest, such as MFT entries, are encountered. Such a Streak is considered to have ended after nothing of interest was found in NoStreak sectors. NoStreak for Level 1 is 0, so GetDataBack does not try to find adjacent structures in Level 1.

The final parameter to understand is the Thieve width. It is applied to Level 3 only and adds 8 sectors every Thieve sectors to the LAI. Let's say you have a drive with 1,000,000,000 sectors and a Thieve width of 100000. The sectors 0-7, 100000-100007, 200000-200007, etc., are added to the LAI, assuring that the entire drive is probed for interesting structures.

Running Times and Drive Stress

LEVEL | PURPOSE | LAI BRACKET | LAI NOSTREAK | LAI THIEVE | Scan Time*) File Systems | Scan Time*) Recovery Tree | Total Time*) | Sectors Read*)
1 (*) | Mount file system, fastest | 100 | 0 | No | 3 seconds | 4 minutes | 00:04:03 | 0.28%
2 (**) | Intelligent file system scan and recovery, fast | 1000 | 16 | No | 30 seconds | 4 minutes | 00:04:30 | 0.32%
3 (***) | Thorough file system scan and recovery | 1000000 | 1030 | Between 10,000 and 100,000 depending on the drive size | 18 minutes | 45 minutes | 01:03:00 | 2.65%
4 (****) | Complete drive scan, find any data trace, slow | ∞ | ∞ | n/a | 6 hours | 1 hour | 07:00:00 | 101 %
*)Test HD was a 1 TB SSD, completely filled NTFS partition with 1.3 million active files, 5 million MFT entries.

The table above shows stats for running GetDataBack with different levels. Levels 1 and 2 are very fast, with limited stress on the drive. This reduced stress is a positive factor to consider if your drive has mechanical problems. Usually, drives with mechanical problems should be imaged first, but an image will always (try to) read 100% of the drive. If you only need a handful of files, and can get away with scanning under 1% of the drive, skipping the image might be a proper course of action.

The sophistication levels are cascading. If GetDataBack finds nothing of value in level 1, it continues with level 2, then level 3, and finally the complete scan.

The higher the level, the more cluttered your Recovery Tree is. In data recovery, "more is better" does not always apply, as it might drown the files you are looking for in a barrage of years-old, long deleted, and unwanted information.

Changing the Level

If you want to change the sophistication level, you will most likely do so in the Select File System screen. The purple tile in the left bottom shows the current sophistication level. You can change and increase the level by clicking on the purple tile. If you change the level, it is effective going forward. At the same time, the already completed scan between the Select Drive and the Select File System screen is elevated to the higher level by repeating the scan with the increased level.

You can modify the level right from the start in TOOLS->Settings->Data Recovery->Initial level.

See also: Doing a Data Recovery, Checklist, FAQ


Select APSB

When you pick Apple's new APFS in Select File System, GetDataBack prompts you to choose one or more APFS Superblocks (APSB). Each APSB represents a previous file system state, sorted by the amount of data in it. These states are also called "checkpoints".

The following information helps you choose the right APSBs:

  • Block: APSB block number
  • Data: Amount of data in this APSB
  • No: Volume number
  • Name: Volume name
  • Version: State version, the higher the number, the younger the state.
  • Date: Date/time stamp of that APSB
  • BTOM: BTOM number
  • #Files: Number of files in this state

Select none, one, or more blocks to include in the Recovery Tree. The current APSB block is already included in the Recovery Tree.

APSBs represent different file system states. Instead of deleting a file, APFS increases the APSB version number for current files, leaving deleted data in previous states. That means you can easily recover data you deleted, as long as that data was not purged yet.


File System Details

Right-click a tile in Select File Systems to examine detailed information about that file system. The details are different for every file system.

If you want to learn more about file systems, check out our DiskExplorer and Disk Digger software.

Quick jump to: NTFS, exFAT, FAT, FAT32, EXT, HFS+, APFS

NTFS File System Details
Name Example Value Description
Tile:
NTFS
953 GB
99% @ 0%
953 GB NTFS partition
covering 99% of a 954 GB drive
and beginning at 0%
File system: NTFS File system
Size: 953 GB Capacity
Location: Sector 796,672 Start of file system
Cluster0: Sector 796,672 Location of cluster 0
Cluster size: 8 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 1,997,932,543 Total number of sectors
Total clusters: 249,741,567 Total number of clusters
Data matches/rel: 1/3 CS-SS matches/Percent
Source details: B@796672 BB@1998729215 M@7088128 MM@796688 Sources for this file system:
Boot sector at 796672,
Backup boot sector at 1998729215,
$MFT at 7088128,
$MFTMirr at 796688
Source: B2M2 Short source for this file system:
2 boot records, 2 $MFTs
Recovery tree: Tree NTFS, 1312507 entries Recovery Tree has 1312507 entries
(files & directories), see details below
MFT cluster: 786,432 Cluster number of $MFT
MFTMirr cluster: 2 Cluster number of $MFTMirr
MFT size: 1024 bytes Size of one MFT record (usually 1024)
INDX size: 4096 bytes Size of one INDEX record (usually 4096)
# Mft: 1,237,508 # entries in MFT (files & directories)
Explicit Mft no: True Entries contain own MFT# (XP & up)
Area: Ambiguous Source of MFT information
Created: 11/21/2015 2:22:16 AM Date MFT was created
NTFS Recovery Tree
Tree: NTFS, 1312507 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 158,871 # directories in Recovery Tree
Total files: 1,153,635 # files in Recovery Tree
Total size: 978,206,793,071 Total size of files
NTFS Volume: NTFS Volume at 796,672 (1,997,932,543 sectors) See details below
RemoveList: nil Internal
NTFS Volume
Drive: Physical hard drive 954 GB (DISK0:) - SAMSUNG MZFLW1T0HMLH-000MV Name of drive the recovery ran on
Bytes per sector: 512 Byes in one sector (512 or 4096)
Sectors/cluster: 8 Sectors per cluster (8 or power of 2)
Cluster0: 796,672 Location of cluster 0
Sectors in volume: 1,997,932,543 Total number of sectors
Clusters in volume: 249,741,567 Total number of clusters
BitMapFree: 0 internal
Mft1stCluster: C0000 1st cluster of $MFT (hex)
MftMirr1stCluster: 2 1st cluster of $MFTMirr (hex)
MftRecSize: 1024 Size of one MFT record (usually 1024)
IndexBufferSize: 4096 Size of one INDEX record (usually 4096)
Area: Ambiguous Source of MFT information
Secondaries: 10806 secondary items, 0 keys Number of files with more than one MFT record

EXFAT File System Details
Name Example Value Description
Tile:
EXFAT
477 GB
99% @ 0%
477 GB exFAT partition
covering 99% of a 477 GB drive
and beginning at 0%
File system: EXFAT File system
Size: 477 GB Capacity
Location: Sector 65,536 Start of file system
Cluster0: Sector 130,048 Location of hypothetical cluster 0
Cluster size: 512 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 1,000,079,360 Total number of sectors
Total clusters: 1,953,280 Total number of clusters
Data matches/rel: 0/0 CS-SS matches/Percent
Source details: B@65536BB@65548 Sources for this file system:
Boot sector at 65536,
Backup boot sector at 65548
Source: B2 Short source for this file system:
2 boot records
Recovery tree: Tree EXFAT, 64202 entries Recovery Tree has 64202 entries
(files & directories), see details below
Total files: 59,595 Number of files
Total directories: 4,606 Number of directories
Total file size: 402 GB Total size of files
# dirhash entries: 64,202 # entries in dirhash
Cluster2: Sector 131,072 Location of cluster 2 (first used cluster number)
FAT1: Sector 98,304 Location of FAT1
FAT2: Sector -1 no FAT2
FAT length: 32,768 sectors Length of one FAT
1st root cluster: 4 First cluster of root directory
Root dir: Sector 132,096 First sector of root directory
EXFAT Recovery Tree
Tree: EXFAT, 64202 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 4,606 # directories in Recovery Tree
Total files: 59,595 # files in Recovery Tree
Total size: 431,446,518,341 Total size of files
MergedFat: FAT length: 4194304 entries, 12 chains See details below
LFNWork: 0 entries Internal
LFNFrags: 0 entries Internal
FirstRootCluster: 4 First cluster of root directory
RootChain: 1 elements, 000004 Description of root's FAT chain
EndingClusters: TList2 (11FE): 4 5 8 9 D616A D616B D616C D616D D616E D616F...(11F4 more)... EOF markers in FAT
Filled by mounting: TRUE Recovery Tree created from boot record (mounting)
Filled by FAT: FALSE Recovery Tree created from FAT (smart scan)
Filled by scan: FALSE Recovery Tree created from full scan
EXFAT Merged FAT
MergedFat: FAT length: 4194304 entries, 12 chains # entries in FAT, # chains in FAT(only fragmented chains listed in exFAT)
Chains
1 cluster: 00000000
1 cluster: 00000001
1 cluster: 00000002
1 cluster: 00000003
1 cluster: 00000004
219190 clusters: 0000000B- 0000000C- 0000000D- 0000000E- 0000000F- 00000010- 00000011- 00000012- 00000013- 00000014- 00000015-...
219211 clusters: 0003584A- 0003584B- 0003584C- 0003584D- 0003584E- 0003584F- 00035850- 00035851- 00035852- 00035853- 00035854-...
219233 clusters: 0006B09E- 0006B09F- 0006B0A0- 0006B0A1- 0006B0A2- 0006B0A3- 0006B0A4- 0006B0A5- 0006B0A6- 0006B0A7- 0006B0A8-...
219223 clusters: 000A0908- 000A0909- 000A090A- 000A090B- 000A090C- 000A090D- 000A090E- 000A090F- 000A0910- 000A0911- 000A0912-...
734106 clusters: 000D962F- 000D9630- 000D9631- 000D9632- 000D9633- 000D9634- 000D9635- 000D9636- 000D9637- 000D9638- 000D9639-...
...2 more

FAT File System Details
Name Example Value Description
Tile:
FAT12
1.39 MB
98% @ 1%
1.39 MB FAT partition
covering 98% of a 1.41 MB drive
and beginning at 1%
File system: FAT12 File system
Size: 1.39 MB Capacity
Location: Sector 1 Start of file system
Cluster0: Sector 31 Location of hypothetical cluster 0
Cluster size: 1 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 2,849 Total number of sectors
Total clusters: 2,849 Total number of clusters
Data matches/rel: 13/52 CS-SS matches/Percent
Source details: D5@1336/1428 Sources for this file system:
Subdirectories at sectors 1336, 1428, and 3 more
Source: D5 Short source for this file system:
5 subdirectories
Recovery tree: Tree FAT12, 48 entries, 0 LFN work entries Recovery Tree has 48 entries
(files & directories), see details below
Total files: 29 Number of files
Total directories: 6 Number of directories
Total file size: 722 KB Total size of files
# dirhash entries: 48 # entries in dirhash
Cluster2: Sector 33 Location of cluster 2 (first used cluster number)
FAT1: Sector 1 Location of FAT1
FAT2: Sector 10 Location of FAT2
FAT length: 9 sectors Length of one FAT
# root dir entries: 224 Max. space for root dir entries
Root dir: Sector 19 First sector of root directory
FAT Recovery Tree
Tree: FAT12, 48 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 6 # directories in Recovery Tree
Total files: 29 # files in Recovery Tree
Total size: 739,128 Total size of files
MergedFat: FAT length: 3072 entries, 36 chains See details below
LFNWork: 0 entries Internal
LFNFrags: 0 entries Internal
FirstRootCluster: 0 n/a
RootChain: 1 elements, 000 n/a
EndingClusters: TList2 (6): 317 388 3F9 46A 519 575 EOF markers in FAT
Filled by mounting: TRUE Recovery Tree created from boot record (mounting)
Filled by FAT: FALSE Recovery Tree created from FAT (smart scan)
Filled by scan: FALSE Recovery Tree created from full scan
FAT Merged FAT
MergedFat: FAT length: 3072 entries, 36 chains # entries in FAT, # chains in FAT
Chains
1 cluster: 00000001
15 clusters: 00000002- 00000003- 00000004- 00000005- 00000006- 00000007- 00000008- 00000009- 0000000A- 0000000B- 0000000C-...
17 clusters: 00000011- 00000012- 00000013- 00000014- 00000015- 00000016- 00000017- 00000018- 00000019- 0000001A- 0000001B-...
15 clusters: 00000022- 00000023- 00000024- 00000025- 00000026- 00000027- 00000028- 00000029- 0000002A- 0000002B- 0000002C-...
15 clusters: 00000031- 00000032- 00000033- 00000034- 00000035- 00000036- 00000037- 00000038- 00000039- 0000003A- 0000003B-...
597 clusters: 00000040- 00000041- 00000042- 00000043- 00000044- 00000045- 00000046- 00000047- 00000048- 00000049- 0000004A-...
1 cluster: 00000295
23 clusters: 00000296- 00000297- 00000298- 00000299- 0000029A- 0000029B- 0000029C- 0000029D- 0000029E- 0000029F- 000002A0-...
89 clusters: 000002AD- 000002AE- 000002AF- 000002B0- 000002B1- 000002B2- 000002B3- 000002B4- 000002B5- 000002B6- 000002B7-...
12 clusters: 00000306- 00000307- 00000308- 00000309- 0000030A- 0000030B- 0000030C- 0000030D- 0000030E- 0000030F- 00000310-...
...26 more

FAT 32 File System Details
Name Example Value Description
Tile:
FAT32
3.84 GB
99% @ 0%
1,024 MB EXT partition
covering 100% of a 1,024 MB drive
and beginning at 0%
File system: FAT32 File system
Size: 3.84 GB Capacity
Location: Sector 2,048 Start of file system
Cluster0: Sector 17,802 Location of hypothetical cluster 0
Cluster size: 8 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 8,049,270 Total number of sectors
Total clusters: 1,006,158 Total number of clusters
Data matches/rel: 51/66 CS-SS matches/Percent
Source details: B@2048 BB@2054 D9@28994/38154 Sources for this file system:
Boot sector at 2048,
Backup boot sector at 2054,
Subdirectories at sectors 28994, 38154, and 7 more
Source: B2D9 Short source for this file system:
2 boot records, 9 subdirectories
Recovery tree: Tree FAT32, 4475 entries, 49 LFN work entries Recovery Tree has 4475 entries
(files & directories), see details below
Total files: 4,237 Number of files
Total directories: 79 Number of directories
Total file size: 3.82 GB Total size of files
# dirhash entries: 4,475 # entries in dirhash
Cluster2: Sector 17,818 Location of cluster 2 (first used cluster number)
FAT1: Sector 2,080 Location of FAT1
FAT2: Sector 9,949 Location of FAT2
FAT length: 7,869 sectors Length of one FAT
1st root cluster: 2 First cluster of root directory
Root dir: Sector 17,818 First sector of root directory
FAT32 Recovery Tree
Tree: FAT32, 4475 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 79 # directories in Recovery Tree
Total files: 4,237 # files in Recovery Tree
Total size: 4,106,365,082 Total size of files
MergedFat: FAT length: 1007232 entries, 4080 chains See details below
LFNWork: 49 entries Internal
LFNFrags: 2 entries Internal
FirstRootCluster: 2 First cluster of root directory
RootChain: 1 elements, 000002 Description of root's FAT chain
EndingClusters: TList2 (4F): 2 3 6 7 539 53A 53B 549 577 9F0...(45 more)... EOF markers in FAT
Filled by mounting: TRUE Recovery Tree created from boot record (mounting)
Filled by FAT: FALSE Recovery Tree created from FAT (smart scan)
Filled by scan: FALSE Recovery Tree created from full scan
FAT32 Merged FAT
MergedFat: FAT length: 1007232 entries, 4080 chains # entries in FAT, # chains in FAT
Chains
1 cluster: 00000000
1 cluster: 00000002
1 cluster: 00000003
1 cluster: 00000004
1 cluster: 00000005
1 cluster: 00000006
1 cluster: 00000007
698 clusters: 00000008- 00000009- 0000000A- 0000000B- 0000000C- 0000000D- 0000000E- 0000000F- 00000010- 00000011- 00000012-...
631 clusters: 000002C2- 000002C3- 000002C4- 000002C5- 000002C6- 000002C7- 000002C8- 000002C9- 000002CA- 000002CB- 000002CC-...
1 cluster: 00000539
...4070 more

EXT File System Details
Name Example Value Description
Tile:
EXT
1,024 MB
100% @ 0%
3.84 GB FAT32 partition
covering 99% of a 3.85 GB drive
and beginning at 0%
File system: EXT File system
Size: 1,024 MB Capacity
Location: Sector 2 Start of file system
Cluster0: Sector 0 Location of hypothetical cluster 0
Cluster size: 8 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 2,097,152 Total number of sectors
Total clusters: 262,144 Total number of clusters
Data matches/rel: 0/0 CS-SS matches/Percent
Source details: S>0 G0@2 G1@262144 G3@786432 Chained sparse superblocks:
FS origin is at sector 0,
Group 0 superblock is at sector 2,
Group 1 superblock is at sector 262144,
Group 3 superblock is at sector 786432
Source: S7 7 chained sparse superblocks confirm this file system
Recovery tree: Tree EXT, 246 entries Recovery Tree has 246 entries
(files & directories), see details below
Total files: 239 Number of files
Total directories: 6 Number of directories
Total file size: 928 MB Total size of files
# dirhash entries: 246 # entries in dirhash
Superblock location: Sector 2 Sector of first superblock
SB grp strt secs: 0(0) 1(262144) 3(786432) 5(1310720) 7(1835008) Sparse superblock group(start sector)
# groups (d): 8 # groups in file system
# blks/grp desc (d): 1 (8 sectors) # blocks per group description
SuperBlocks at blks: (5): 0 1 3 5 7 Blocks with superblocks
# inodes: 65536 # inodes in file system
# blocks: 262144 # blocks in file system
# res. blocks: 13107 # reserved blocks for superuser
# free blocks: 16404 # free blocks
# free inodes: 65274 # free inodes
1st data block: 0 First data block
log block size: 2 (4096 bytes) 0-1024, 1-2048, 2-4096
fragment size: 2 Fragment size
# blocks/group: 32768 # blocks per group
# fragments/group: 32768 # fragments per group
# inodes/group: 8192 # inodes per group
Mount time: 3/13/2014 11:47:01 AM Last mount time
Write time: 3/13/2014 11:47:01 AM Last write time
Mount count: 4 Mount count
Max. mount count: 65535
Magic signature: 0xEF53 (VALID) EF53=Valid
File system state: 1 (Cleanly unmounted) 1=OK
Minor rev. level: 0
Last check: 3/11/2014 4:23:03 PM Time of last check
Max. time bw chks: 0 seconds (0 days)
Creator OS: 0 (Linux)
Inode size: 256 bytes Inode size
Block group: 0 Number of this block group
Compat flag: 60 HAS_JOURNAL EXT_ATTR RESIZE_INODE DIR_INDEX
Incompat flag: 582 FILETYPE RECOVER EXTENTS FLEX_BG
RO compat flag: 123 SPARSE_SUPER LARGE_FILE HUGE_FILE GDT_CSUM DIR_NLINK EXTRA_ISIZE
Volume name: 1gExt4 Volume name
Last mounted dir: /media/sdb Last mounted volume
File system creation: 3/11/2014 4:23:03 PM Date file system was created
Min. inode size: 28
New inode size: 28
Flags: 1 (SIGNED_DIR_HASH)
RAID stride: 0
RAID stripe width: 0
KB written: 1,007,125 Number KB written to this file system over its lifetime
# errors seen: 0
1st error time: 12/31/1969 2:00:00 PM
1st error inode: 0
1st error block: 0
1st error func:
1st error line: 0
last error time: 12/31/1969 2:00:00 PM
last error inode: 0
last error block: 0
last error func:
last error line: 0
EXT Recovery Tree
Tree: EXT, 246 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 6 # directories in Recovery Tree
Total files: 239 # files in Recovery Tree
Total size: 972,877,063 Total size of files

HFS+ File System Details
Name Example Value Description
Tile:
HFS
3.59 GB
91% @ 5%
3.59 GB HFS+ partition
covering 91% of a 3.91 GB drive
and beginning at 5%
File system: HFS File system
Size: 3.59 GB Capacity
Location: Sector 409,642 Start of file system
Cluster0: Sector 409,640 Location of hypothetical cluster 0
Cluster size: 8 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 7,520,176 Total number of sectors
Total clusters: 940,022 Total number of clusters
Data matches/rel: 0/0 CS-SS matches/Percent
Source details: H>409640@409642 HB@7929814 ceaf, miw, 33
Source: H33
Recovery tree: Tree HFS+, 113 entries Recovery Tree has 113 entries
(files & directories), see details below
Total files: 83 Number of files
Total directories: 29 Number of directories
Total file size: 44.6 MB Total size of files
# dirhash entries: 113 # entries in dirhash
Volume header sector: 409642 Sector number volume head was found
HFS+ Signature: H+
Version: 4
Attributes: 0x80002100
Last mounted version: HFSJ
Attr interpreted: [umnted][b13]
Reserved: 00 00 00 1E
Created: 2/7/2017 8:30:24 PM
Modified: 2/8/2017 4:36:19 AM
Backuped: 1/1/1904
Checked: 2/8/2017 4:30:24 AM
File count: 83
Folder count: 28
Block size: 4096
Total blocks: 940022
Free blocks: 924455
Next allocation: 294912
Rsrc clump size: 65536
Data clump size: 65536
Next catalog ID: 158
Write count: 314
Encodings bitmap: 00 00 00 00 00 00 00 01
Finder info: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 21 92 07 CF D3 0C
Allocation file: 118,784 bytes (29 blocks) 1(29) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0)
Extents file: 4,194,304 bytes (1,024 blocks) 2079(1024) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0)
Catalog file: 6,291,456 bytes (1,536 blocks) 19999(1536) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0)
Attributes file: 6,291,456 bytes (1,536 blocks) 3103(1536) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0)
Startup file: 0 bytes (0 blocks) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0) 0(0)
HFS+ Recovery Tree
Tree: HFS+, 113 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 29 # directories in Recovery Tree
Total files: 83 # files in Recovery Tree
Total size: 46,718,848 Total size of files

APFS File System Details
Name Example Value Description
Tile:
APFS
3.69 GB
94% @ 5%
3.69 GB APFS partition
covering 94% of a 3.89 GB drive
and beginning at 5%
File system: HFS File system
Size: 3.69 GB Capacity
Location: Sector 409,640 Start of file system
Cluster0: Sector 409,640 Location of hypothetical cluster 0
Cluster size: 8 sectors Cluster size
Phys. sector size: 512 bytes Bytes per Sector (512 or 4096)
Total sectors: 7,743,408 Total number of sectors
Total clusters: 967,926 Total number of clusters
Data matches/rel: 0/0 CS-SS matches/Percent
Source details: N23>409640@409640
Source: N23
Recovery tree: Tree APFS, 167064 entries Recovery Tree has 167064 entries
(files & directories), see details below
Total files: 166,746 Number of files
Total directories: 317 Number of directories
Total file size: 3.17 GB Total size of files
# dirhash entries: 167,064 # entries in dirhash
NXSB: 409640 Sector number the NXSB was found
Checksum: 0xB1EB4FF28F8C3436
NodeID: 1
Version: 6,016
BlockType: 0x80000001/0
Magic: NXSB
Block size: 4,096 bytes
Total blocks: 967,926
UUID: 2FAD7025-D5D1-4F43-A735-802BD787A951
Next free node ID#: 17,544
Next version: 6,017
Superblock area blk cnt: 44
Spaceman area blk cnt: 3,772
Superblock area start blk: 1
Spaceman area start blk: 45
Next superblock map blk: 20
Next spaceman blk: 2,427
Cur superblock map blk: 18
Cur superblock map blk cnt: 2
Cur spaceman blk: 2,423
Cur spaceman blk cnt: 4
Spaceman node ID#: 1,024
Volume root blk#: 317,939
Max volumes: 8
Volume node IDs: 1,026 CAPTURE 5/11/2020 11:36:22 PM
APFS Recovery Tree
Tree: APFS, 167064 entries Tree root name, number of files & directories
Swap to: Memory Swap area: Memory, Disk, or Auto
Total directories: 317 # directories in Recovery Tree
Total files: 166,746 # files in Recovery Tree
Total size: 3,405,157,602 Total size of files

See also: Checklist, Drive details, File details, Recovery info


Recovery Tree

This screen looks similar to Windows Explorer. On the left side, you see the recovery tree with all the recovered directories. When you open a directory on the left side, the recovered files in this directory are displayed on the right side.

File->View

We recommend you view a couple of files before copying them to a secure medium. Testing them ensures the recovery was successful, and the files are in good condition: Double-click, press Enter or F3 to view a file's content. GetDataBack comes with a couple of build-in viewers, such as JPG, BMP, PDF, DOC, ZIP, and more. If the file type is unknown or the particular viewer is unable to open a file, the build-in hex viewer displays the file's content.

File->Open

In contrast to View, Open attempts to open a file with its associated application. To accomplish that, GetDataBack puts a copy of the file into your computer's temporary directory and invokes its native Windows application. Thus you can check and open almost any file type as long as the file is self-sufficient.

File->Copy

You are now ready to copy the files to a secure medium, such as a USB drive or a network drive. Tag the files or directories you want to copy. Push F5, and a window lets you choose the destination for the files. This destination can either be another hard drive or a network drive.

***Never copy the files to the drive you are recovering***

You can copy the entire directory tree by selecting the root entry on the left side, [EXFAT]. If you want to copy selected directories or files, you can select them in the right window. On the right, hold the CTRL-key to choose multiple files or directories.

Copying files to a secure medium requires you to buy a license key for the software. Inserting this key is quick and easy. You don' t have to repeat the recovery process; just enter the license key from here to enable copying your files.

Deleted Files and Duplicate Entries

These two checkboxes determine if GetDataBack includes deleted files or duplicate entries in the recovery tree. Deleted files are files marked as deleted by the file system, but they might still be retrievable. Duplicates are present when one directory contains more than one file with the same name. Click the checkboxes if you want any of these types of files included.

In Windows file systems, you find recovered deleted files in their original directory where a crossed-out filename marks them. If you are looking for files from an emptied recycle bin, you should look below the RECYCLE directory. Note that files inside the recycle bin do not bear their original filenames. However, they still have their original extension.

Not all file systems support the recovery of deleted files. The Windows file systems do, while the ones for Linux EXT and Apple HFS+ do not.

If you allow duplicate files and try to copy them, a prompt asks you to either overwrite, skip or rename these files. If you choose skip or overwrite, you can end up with file versions that are not necessarily the ones you wish to recover. If you choose rename instead, you can later sort out which files are the most current versions. With duplicates switched off, GetDataBack shows only the most recent file entry. If you mix deleted on with duplicates off, GetDataBack shows the most recent file entry, even if this is marked deleted, while suppressing an eventual not deleted version.

You can rename duplicate files manually, so they won't collide when copying.

Quality of the Recovery

Don't feel anxious about the recovery results after copying the files. In most cases, what you see in the recovery tree is what you get after copying the files. That means, if you can see your files in the recovery tree and their content looks all right, they most likely are all right after saving them.

However, we recommend to check several files. Use the following features of GetDataBack to verify the quality of the recovery:

  • View the file (FILE->View, Double-click, or Enter)
  • Open the file with its native application (FILE->Open)
  • Investigate the file information for the file (FILE->Info)

Sometimes you have directories in the recovery tree with names similar to this one: 1229BD. That means that the root directory entry for this directory was lost, and the directory name could not be retrieved. The subdirectories (if there are any) and the files in the directory should nevertheless be in order.

If you have problems opening the recovered files, please see our checklist .

Troubleshooting

What if you don't see your files and directories in the Recovery Tree screen?

If you don't see the files you are looking for at all, go back to the Select File System screen and try other file system entries (if there are any). If you still cannot find your data, click on the purple Level rectangle in the lower-left corner. Here you can increase the thoroughness with which GetDataBack scans the drive. Possible are levels * up to ****. If you still cannot find your data, send us a snapshot of your recovery, along with a short description of what happened to your drive.

What if all you see on the left side is a list of numbered directories, but no or little directories with real names?

The root directory structure of your drive could not be recovered. That doesn't automatically mean that the files and filenames are unrecoverable as well. Look into the directories - if you are lucky, the subdirectory names and filenames are intact, and those files open just fine.
You may also go back to the Select File System screen and try other file system entries. Try to increase the Level. If this still does not help, send us a snapshot of your recovery.

What if you see a bunch of familiar files and directories, but the specific files you are looking for are not there?

Search for your files - they may be hidden in some directory where you wouldn't expect them. To search for files, click on File->Search. Enter a part of the filename or the file's extension into the search mask (e.g., "*.jpg" or "myfiles*.*"). If you are still unable to locate the data you need, go back to the Select File System screen and try other entries. Try to increase the Level. If this still does not help, send us a snapshot of your recovery.

What if you see your directores, files, filenames - even with the right file size - but when you try to open a file to test it, it either won't open at all, or all you see are weird hex characters instead of your file content?

There is something wrong with your recovery at this point, and you won't be able to recover your files like that. First, go back to the Select File System screen and try other file system entries. If that does not help, please send us a snapshot.

Save the Recovery

At this point, you can save the current state of the recovery and continue later. Go to DRIVE->Save current recovery and choose a filename. This feature does not save the recovered files. It saves the status and structure of the recovery tree only. To save the recovered files, see Copy .

***Never save this file on the drive you are recovering***

Sort

Sort the files on the right side by size, name, attributes, creation date, and so on by clicking on the corresponding column header.

Rename

If the correct filenames do not come up (for instance, because the root directory information is destroyed), you can rename the files before copying them. Select the file or directories you wish to rename and press F2. This feature comes in handy when you are dealing with duplicates. Of course, you can also rename the files after you have copied them to a secure location.

Search

GetDataBack includes a file search function. Go to FILE->Search and type in the search term.

Appearance of the Filenames - Attributes

Appearance | Meaning
filename.ext | normal file or directory
filename.ext | read-only
filename.ext | system
filename.ext | hidden
filename.ext | compressed
filename.ext | deleted

File information

If you want to dive deeper into your recovery, you can look at the file information. Right-click the file you are interested in and click Info.

Navigation

Use the small left and right arrows in the top left corner for going back and forth between the screens. Pressing the left arrow brings you back to the Select File System screen. Press the right arrow, and you move forward to the next screen. You can navigate between the screens without losing the progress. If a process needs to unload a current recovery, it warns you beforehand.

See also: View file, File information, Save recovery, Search, Checklist, License key

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


View File

The View File feature can display many file formats. For binary and unknown formats, it uses a HEX viewer. It opens files very quickly, so you can easily go from file to file, checking their content.

Highlight the file you want to view in the Recovery Tree and click F3 or ENTER.

Supported files:

  • Document files: TXT, DOC, DOCX, RTF, PDF, HTM, and many more
  • Graphic files: BMP, ICO, WMF, JPG, JPEG, GIF, PNG, PSD, RAW, and many more
  • Binary files: ZIP
  • All other files: generic HEX viewer

The viewer's title line contains the name of the currently viewed file, as well as the name of the copy of that file in the temp directory.

The viewer derives the file format from the file extension. If the file is corrupted and the viewer can not display the file according to its extension, the HEX viewer displays it.

In the viewer, you can change how the currently loaded file is displayed. For example, you can switch from IMAGE to HEX if you want to examine the file on the byte level.

The viewer creates files in the temporary files directory. Make sure that directory is not on the drive you want to recover.


File Information

View detailed information about a file or directory displayed in the Recovery Tree by selecting the entry and clicking FILE->Info. The details differ depending on the underlying file system.

If you want to learn more about file systems, check out our DiskExplorer and Disk Digger software.

Quick jump to: NTFS, exFAT, FAT, FAT32, EXT, HFS+, APFS

NTFS - File Details
Property Example Value Description
Name: Winre.wim Name of file or directory
ID: 27 Internal ID, cannot be duplicate
No: 38 File no, might be duplicate
ParentNo: 37 File no of the containing directory
Allocation: MftEntry
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
Virtual: | Entries created by GetDataBack | n/a | All
MftEntry: | Allocation was provided by MFT entry | Good | NTFS
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 426 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 3/27/2019 6:30:14 AM
Created: 3/27/2019 6:30:28 AM
Last accessed: 3/27/2019 6:30:28 AM
Attributes: ___sh__ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 000177E0 First cluster of file
First sector: 1,999,499,008 First sector of file
Resident: False Data attribute is not resident
MFT#: 0x26 (38) MFT # of file (=file no above)
Parent MFT#: 0x25 (37) MFT # of containing directory
MFT sectors: 1,999,289,076(2) Sectors this MFT was found

EXFAT - File Details
Property Example Value Description
Name: SysTools.pdf Name of file or directory
ID: 16842 Internal ID, cannot be duplicate
No: 0 reserved
ParentNo: 0 reserved
Allocation: Extent
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
OneCluster: | File consists of one known cluster | Good | FAT, FAT32, exFAT
FirstCluster: | File's first cluster is known, remaining clusters continuous | Medium | FAT, FAT32, exFAT
Fat: | Allocation was provided by FAT table | Good | FAT, FAT32, exFAT
Plan-B: | File's first cluster is known, remaining clusters guessed | Medium | FAT, FAT32, exFAT
Virtual: | Entries created by GetDataBack | n/a | All
Extent: | Allocation was provided by Extent information | Good | exFAT, HFS+, APFS
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 12.4 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 2/27/2002 12:27:56 AM
Created: 4/17/2020 11:26:24 AM
Last accessed: 4/17/2020 11:26:24 AM
Attributes: a______ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 192209+ First cluster of file
First sector: 843,451,904 First sector of file
Found@cluster: 1647097 Cluster no where this dir entry was found
LFN: SysTools.pdf Long file name
Cluster chain: 0x192209(50) 50 clusters starting at cluster 0x192209
Ignore FAT: True True=FAT does not provide allocation because Extent does, False=FAT provides allocation

FAT - File Details
Property Example Value Description
Name: headcrash.wav Name of file or directory
ID: 164 Internal ID, cannot be duplicate
No: 0 reserved
ParentNo: 0 reserved
Allocation: Fat
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
OneCluster: | File consists of one known cluster | Good | FAT, FAT32, exFAT
FirstCluster: | File's first cluster is known, remaining clusters continuous | Medium | FAT, FAT32, exFAT
Fat: | Allocation was provided by FAT table | Good | FAT, FAT32, exFAT
Plan-B: | File's first cluster is known, remaining clusters guessed | Medium | FAT, FAT32, exFAT
Virtual: | Entries created by GetDataBack | n/a | All
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 17.3 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 9/6/2001 6:11:08 PM
Created: 11/9/2001 1:04:10 AM
Last accessed: 11/9/2001
Attributes: a____r_ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 0001CB+ First cluster of file
First sector: 1,982 First sector of file
Found@cluster: 458 Cluster no where this dir entry was found
LFN: headcrash.wav Long file name
Cluster chain: 0x192209(50) 50 clusters starting at cluster 0x192209
Ignore FAT: False False=FAT provides allocation

FAT32 - File Details
Property Example Value Description
Name: headcrash.wav Name of file or directory
ID: 413 Internal ID, cannot be duplicate
No: 0 reserved
ParentNo: 0 reserved
Allocation: Fat
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
OneCluster: | File consists of one known cluster | Good | FAT, FAT32, exFAT
FirstCluster: | File's first cluster is known, remaining clusters continuous | Medium | FAT, FAT32, exFAT
Fat: | Allocation was provided by FAT table | Good | FAT, FAT32, exFAT
Plan-B: | File's first cluster is known, remaining clusters guessed | Medium | FAT, FAT32, exFAT
Virtual: | Entries created by GetDataBack | n/a | All
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 17.3 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 9/6/2001 6:11:08 PM
Created: 11/9/2001 1:04:42 AM
Last accessed: 11/9/2001
Attributes: a____r_ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 0000ED+ First cluster of file
First sector: 3,946 First sector of file
Found@cluster: 236 Cluster no where this dir entry was found
LFN: headcrash.wav Long file name
Cluster chain: 0x0000ED(4436) 4436 clusters starting at cluster 0x0000ED
Ignore FAT: False False=FAT provides allocation

EXT - File Details
Property Example Value Description
Name: Delphi_Reference.pdf Name of file or directory
ID: 1241 Internal ID, cannot be duplicate
No: 30604 File no, might be duplicate
ParentNo: 30601 File no of the containing directory
Allocation: None
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
Virtual: | Entries created by GetDataBack | n/a | All
None: | Default allocation provided by inode information | Good | EXT
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 4.45 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 8/1/2002 7:37:41 AM
Created: 2/3/2089 8:16:32 AM
Last accessed: 10/14/2007 3:19:06 PM
Attributes: _______ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 000352DB First cluster of file
First sector: 00000000 First sector of file
Inode no: 30604 Cluster no where this dir entry was found
#Hard links: 1 Number of hard links for this file
File mode: -rw-r--r-- Linux file mode
Blocks: 0352DB 0352DC 0352DD 0352DE 0352DF 0352E0 0352E1 0352E2 0352E3 0352E4 0352E5 0352E6 0352E7 0353E8 000000
Direct blocks Singly Indirect Block Doubly Indirect Block Triply Indirect Block
EXT4 only
Inode flags: EXTENTS Linux file mode
Extents: Uses 1 of 4 entries, depth is 0 VCN0(1015) at LCN225328

HFS+ - File Details
Property Example Value Description
Name: IMG_3112.JPG Name of file or directory
ID: 241 Internal ID, cannot be duplicate
No: 262 File no, might be duplicate
ParentNo: 250 File no of the containing directory
Allocation: Extent
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
Virtual: | Entries created by GetDataBack | n/a | All
Extent: | Allocation was provided by Extent information | Good | exFAT, HFS+, APFS
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 3.10 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 7/24/2005 11:41:22 PM
Created: 3/13/2014 8:27:01 AM
Last accessed: 12/7/2017 3:30:28 AM
Attributes: _______ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 04C567+ First cluster of file
First sector: 00262B3A First sector of file
CatID: 262 Unique file system ID
Valence: -1
Fork extents: 0x4C567(795) One extent describing 795 blocks starting at block 0x4C567

APFS - File Details
Property Example Value Description
Name: IMG_3146.JPG Name of file or directory
ID: 80 Internal ID, cannot be duplicate
No: 8589934782 File no, might be duplicate
ParentNo: 8589934594 File no of the containing directory
Allocation: Extent
Possible values:
Method | Description | Quality | Affected File Systems
Root: | Directory entry which was defined as root by file system | Good | All
Virtual: | Entries created by GetDataBack | n/a | All
Extent: | Allocation was provided by Extent information | Good | exFAT, HFS+, APFS
Properties: FILE FILE - file, DIR - directory, REALDIR - real directory, SUBS - directory containing subdirectories
Size: 4.47 MB Files: file size, directories: size of all files herein
Files: (directories only) Number of files in this directory and below
Directories: (directories only) Number of directories in this directory and below
Last modified: 8/1/2005 12:23:32 AM
Created: 3/13/2014 8:27:03 AM
Last accessed: 2/20/2018 12:13:39 AM
Attributes: _______ a=archive flag, r=read only, h=hidden, s=system, l=volume name, d=directory, c=compressed
Type: FILE FILE or DIR
First cluster: 0013F4+ First cluster of file
First sector: 0006DFC8 First sector of file
VCID: 2-190 Composed volume-catalog ID
Mode: -rwx------ Linux-style file mode
Fork extents: 5108(1145) One extent describing 1145 blocks starting at block 5108

See also: Drive details, File system details, Recovery Info


Search

GetDataBack provides a comfortable file search function. To search for files or directories, click File->Search.

The File mask field expects a filename mask, such as *.* or *.jpg.

Three different kinds of filters are available:

  • Date: Specify a start and end date. Only files or directories with a modification date within this range show up.
  • Size: Specify a size range. Only fitting files show up.
  • Type: Specify if you want to search for deleted files, not deleted files, or both.

The Search depth field determines how deep GetDataBack searches inside the directory structure. A value of 8 means it searches up to 8 sub-directories.

Click Start to begin searching the whole Recovery Tree according to your settings.

You can Stop the search at any time.

Upon completion of the search, you can inspect the found files and directories in the lower window. You can do the same things you can in the Recovery Tree: view, open, info, sort, copy, etc.

The Sync button brings you to the position of the file in the recovery tree.

The Clear button clears the current results.

The search stops once the number of found files reaches 10,000.


Recovery Info

Review details about the ongoing recovery by going to FILE SYSTEM->Recovery info. The list below shows the file system structure in the left column and its recurrence in the middle column. The right column describes the structure. Click on the middle column to get a list of the findings. For example, click 50 to the right of # MFT below, to get the sector numbers where the items were found.

Recovery Details
Name | Example Value | Description
Drive: | Physical hard drive 954 GB (DISK0:) - SAMSUNG MZFLW1T0HMLH-000MV
NTFS-related findings
# MFT: | 50 | MFT entries found, sectors with signature "FILE"
# $Mft: | 3 | $Mft record found, MFT entry named "$Mft"
List expanded: | 3 $Mft records were found at sectors C2810, 6C2800, 77223010
# $MftMirr: | 3 | $MftMirr record found, MFT entry name "$MftMirr"
# Index: | 12 | Index record found, sectors with signature "INDX"
# NT boot sectors: | 4 | NTFS boot sector found, signature 0xAA55, "NTFS"
FAT-related findings
# FAT32 boot sectors: | 2 | FAT32 boot sector found, signature 0xAA55, "FAT32"
# FAT16 boot sectors: | 0 | FAT boot sectors found, signature 0xAA55, "FAT"
# exFAT boot sectors: | 0 | exFAT boot sectors found, sig 0xAA55, "EXFAT"
HFS+-related findings
# HFS+ volume headers: | 0 | HFS+ volume header found, sig "H+"
# Unused HFS volume headers: | 0 | Unused headers
# HFS node ends: | 18 | HFS+ tree node end
# HFS header nodes: | 0 | HFS+ tree header node
APFS-related findings
# APFS NXSBs: | 0 | APFS superblock found, sig "NXSB"
# APFS APSBs: | 0 | APFS volume superblock found, sig "APSB"
# APFS Blocks: | 0 | APFS block found, signature by BlockID
EXT-related findings
# EXT Superblocks: | 0 | EXT superblocks found, sig 0xEF53
# XFS Superblocks: | 0 |
FAT-related findings
# 12-bit FATs: | 0 | 12-bit FAT, found by structure analysis
# 16-bit FATs: | 0 | 16-bit FAT, found by structure analysis
# 32-bit FATs: | 2 | 32-bit FAT, found by structure analysis
# EXFAT FATs: | 0 | exFAT, found by structure analysis
# Directory starts: | 52 | DIrectory starts found, sig ".", ".."
# Directory conts: | 309 | Directory continuations found, by structure analysis
# exFAT Directory roots: | 0 | exFAT root dir, found by structure analysis
# exFAT Directory starts: | 0 | exFAT dir starts, found by structure analysis
# exFAT Directory conts: | 2 | exFAT dir conts, found by structure analysis
Dir tracker list: | 52 entries | List of sectors with a cluster self-reference (".")
FAT analyze list: | 50 entries | FAT worklist
FAT cache: | 6 entries | FAT description
CrissCross: | Level 1, 110,064 sectors in 26 chunks | Sophistication level, list of sectors to visit
CrossCrossMemo: | L1/Br100/Dry0 | Level 1 / Bracket 100 / NoStreak 0 / Thieve none
Sectors starts: | 509 | Identified file starts
Cluster starts: | 1,521 | Identified cluster starts
All clusters: | 375 |
Cl sizes: | 28 |
File system list: | 5 items |
Selected file system: | NTFS at sector 796,672, cluster size 8 (953 GB) more...
ID: | 1302511837 created 5/15/2020 2:12:04 PM | Recovery ID, date

See also: Sophistication level


Save and Load Recovery

Save Recovery

***Never save any files to the drive you are about to recover***

At any point after choosing a drive, you can save the current status of the recovery to a recovery file (.rec). This feature does not save the recovered files. It saves the status and structure of the recovery tree only. To save the recovered files, see Copy .

Go to DRIVE->Save current recovery and navigate to a location other than the "bad drive". Select a filename and choose between a compact or readable recovery file, then click Save. No matter what you choose, GetDataBack creates a file containing XML code describing the entire data recovery. If you save while in the Recovery Tree, the .rec file lists every single file. As the .rec file is readable, you can use it for your investigations or extract valuable information from it. It tells you the allocation of each file. It is even possible to modify the .rec file, adding or removing files, or changing their allocation.

Of course, the primary purpose of the .rec file is saving the current status for future use. This feature allows you to power down the computer, change the configuration, and load the .rec file and continue with the data recovery.

Load Recovery

You can load a previous recovery in GetDataBack at any point. To load a .rec file, go to DRIVE->Load previous recovery. Navigate to the recovery file and open it. You are now back where you were when you saved the recovery. The underlying drive (bad drive) for the saved recovery must be present when you load it. Otherwise, GetDataBack prompts you for a drive:

Look at the "Signature" of the missing drive, TImgFileDrive:8153087:1702440740. The first part, TImgFileDrive, indicates an Image, 8153087 indicates the number of sectors, and 1702440740 indicates a hash of the drive. Compare this signature to the prompted drives as it must match. Once you identified the correct drive, you can confirm it and proceed. In our example, we had renamed the image we performed the recovery on. After loading the image, GetDataBack suggests this image as its signature matches the signature of the original drive.


Settings

The Settings menu has four tabs, Log & Temp Dir, Data Recovery, File Systems, and Miscellaneous. Click Close once you are done. Reset returns the values to their defaults.

Log & Temp Dir

This tab lets you specify some environmental settings, such as usage of external disk resources and where they are put. Make sure you never write anything to the drive you want to recover.

Log file
Name: | Select a valid filename and check the checkbox to the left to start logging. ***Do not allow this file to be on the drive you want to recover***
Close on each write: | Check this if you want to flush the log file to the disk after each write. That is helpful if you need to catch the last message before a program crash, but it slows the program considerably.
Log level: | Define how talkative the logging is. 0 logs important events and errors only, while 1 frequently adds information about the recovery. 2 adds a complete printout of the Recovery Tree.
Temporary file directory
Use default temp directory: | Put temporary files into your computers temp directory, usually C:\Users\(name)\AppData\Local\Temp\. GetDataBack generates temporary files when you save a recovery or when you view a file. ***Do not allow this directory to be on the drive you want to recover***
Or: | Check this radio button and type in a directory name for temporary files.
Data swap area: | Memory, Auto, or Disk. Default for 64-bit Windows is Memory, default for 32-bit Windows is Auto. This setting determines where GetDataBack's Recovery Tree is stored. That data structure can be massive, depending on the number of files in the recovery. 64-bit system has plenty of memory, while a 32-bit system might require using disk space to prevent the program from running out of memory. The rule of thumb is that 4 GB of RAM is needed for each 6 million files.

Data Recovery

In the Data Recovery tab, you can change settings that control several aspects of the data recovery engine, like sophistication level, bad sector handling, and more.

Data recovery
Smart scan: Smart scan automatically chooses between four different sophistication levels. If you turn this off, GetDataBack scans the entire drive.
Initial level: When Smart Scan is enabled, select the initial sophistication level, between 1 (*) and 4(****)
Bad sectors
Strategy: GetDataBack reads data in blocks of 64 sectors (32 KB). If the read operation fails, the program can Retry the operation for each sector or Skip the entire block. Auto lets the program pick the approach. It is almost always advisable to skip the block. Doing otherwise puts stress on the damaged drive with usually little benefits.
View
Recover deleted files: Presets the value of the Deleted checkbox in the Recovery Tree screen.
Allow duplicate filenames: Presets the value of the Duplicates checkbox in the Recovery Tree screen.
Suppress empty directories: If set, GetDataBack removes empty directories from the Recovery Tree.
Max files: Maximal number of entries GetDataBack shows in the Recovery Tree. Default is 10,000. The limitation only affects the display. If you choose to copy the containing directory, all files are being copied, independent of the value set here.
Filtering
Exclude:

You can exclude files from the Recovery Tree. Usually, you would leave this field empty. Special circumstances, such as memory problems, might justify the exclusion of certain file types. If, for example, you want to exclude TMP and BAK files you would specify:

*.tmp;*.bak
Include: This field determines the files that you want to include in the Recovery Tree. As you usually want to include all files, it is set to *.* by default.

In collaboration with the Exclude above, the filter works in this order:

  1. The program compares files to the Exclude list. If contained therein, they are discarded.
  2. It then compares the remaining files to the Include list. If NOT contained therein, they are discarded.
  3. The remaining files will be included in the Recovery Tree.

Set these options in or before the Select File System screen.

File Systems

Change file system specific settings here. You can include or exclude file systems, or modify how they are recovered.

File systems
NTFS, FAT12, FAT16, FAT32, EXFAT, EXT, HFS+, APFS: | Check all the file systems you want to include in the search for file systems. By default, all file systems are enabled. It is a good idea to uncheck file systems that you know you had not on the drive.
NTFS (only)
Use valid MFT only: | This feature restricts the file entries to those referred to by a valid MFT. Thus, you can get rid of unwanted fake files and reduce cluttering in the Recovery Tree. That is helpful if there are Virtual Machines or backup images on the drive that interfere with GetDataBack's recovery engine. For this to work, though, there must be a valid MFT. Set this option if you have many unwanted files in the Recovery Tree. If you do not find the files you are looking for, make sure this option is off. To be effective, set this option in or before the Select File System screen.
Max depth: | This limits the maximal subdirectory depth.
FAT (only)
Ignore FAT: | Checking Ignore FAT causes GetDataBack to allocate files without using an eventually found FAT. Forgoing the FAT can be useful when the found FAT does not reflect the file system you are currently recovering. It is better to use no FAT than using a FAT containing false information. Check this box only if you are not satisfied with the results in the Recovery Tree. This option must be set in or before the Select Drive screen.
Allow bad directories: | To ensure a high quality of recovery, GetDataBack dismisses information that might look like directories, but most likely is not. Check Allow bad directories if you believe that files or directories are missing in the Recovery Tree or if you want the program to interpret even less promising directory information. This option must be set in or before the Select Drive screen.
EXT (only)
Suppress empty inodes: | If set, do not include empty inodes in the Recovery Tree. This setting prevents clutter in the Recovery Tree.
Search for inodes in unused groups: | If set, the program scans unused groups for inodes. This feature slows down the recovery; therefore, it is turned off by default.
Boot sectors
Search ranges: | The program adds the range or ranges defined here to the list of sectors that it searches for boot sectors. This list can provide a tweak for lower-level scans to find the desired file system.

Miscellaneous

Debug
Audit drive: | This checkbox enables Drive Auditing. When GetDataBack audits a drive, it tracks accessed sectors to later write them to a file for support purposes. The Raster determines the number of sectors taken along with each direct hit.
Show logical drives: | Usually, you only need physical drives, images, or virtual images. If under special circumstances, you wish to add logical drives (C:, D:, etc.) to the screen, you can do so by checking Show logical drives. This checkbox adds a blue tile to the Select Drive screen. Click on it, and the program adds all compatible logical drives as blue tiles.
Readable REC files: | REC files are the files used by Save and Load Recovery. They contain a detailed description of the status of the recovery and the content of the Recovery Tree. If you use "readable" REC files, they are easier to read for humans, but larger.
4KB sectors: | Treat the drive as having 4KB sectors. This setting helps to recover certain drives over 2 TB that use the 4K-sector-hack to address the space beyond 2 TB. GetDataBack tries to adjust to those drives automatically. However, it might need this setting, especially if the drive is no longer accessed through its original USB enclosure.

See also: Sophistication level, Drives, Save & Load Recovery

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Checklist

Use this checklist if you cannot open your recovered files before or after copying ("corrupted files"). It is used to verify and discuss the various choices you made during the recovery process.

We assume you are already familiar with the article Doing a Data Recovery and followed its guidelines. We also assume you have read the descriptions and explanations in the Introduction, the Select Drive screen, the Select File System screen, and the Recovery Tree.

If the recovery results are unsatisfactory, check:
  1. Always use the Physical drive in the Select Drive screen. Use Logical drives if you have to, e.g., your drive does not show up as a physical drive.

  2. Check that the capacity of the "bad drive" shown in the Select Drive screen matches the real capacity of this drive. If it does not match, there might be an issue with your computer, its BIOS, the hard drive controller, or the operating system (Windows), as they might not support the size of your drive, especially if larger than 2 TB.

  3. In the Select File System screen, you have to choose the entry that matches the partition you want to recover BEST. These entries are not necessarily real file systems They merely describe POSSIBLE file systems. The entries at the top have a higher chance of being correct than entries in lower rows. However, GetDataBack made this determination and is not always correct.

    The file sytem is the most critical choice, and you MUST make the correct choice here. Otherwise, the Recovery Tree shows only unusable information. An entry is either right or wrong for a particular partition you want to recover.

    Usually, you go with the first (recommended) entry. We demonstrate a selection procedure below for cases where the first one is wrong (see 5.).

  4. In the Recovery Tree, make sure to check that the files are intact. Use the internal viewer (F3) or open the files with their associated applications. The primary purpose of this check is to verify the selection in the Select File System screen. Use files that are easy to check, e.g., text files, JPG files, EXE files, or DLL files.

    You quickly recognize EXE and DLL files by their beginning "MZ" signature.

    IMPORTANT FOR NTFS: the files you check must be larger than 2KB.

    Interpretation of the file check: If many checks are positive, the selection in Select File System was correct. If no check was positive, the selection in Select File System was wrong, and you have to go back and choose a different entry. If no Select File System entry passes the test, you should increase the sophistication level. That yields additional entries that you can test.

    Note on any non-FAT file system: If a file is corrupted, either it was overwritten, or you have chosen a wrong entry in the Select File System screen.

  5. How to evaluate entries in the Select File System screen?

    GetDataBack uses the information it collected during the scan to generate file system entries. Later, it uses this information to reconstruct the file system that was originally on the drive. By default, the most accurate file system entry is automatically on top of the list. In the example to the left, GetDataBack found two NTFS partitions, one with 14.9 GB and one with 2 GB. The third line of information in each tile indicates the size and position of that partition relative to the containing drive. For this example, we had chosen a 17 GB drive in the Select Drive screen. You can read the tiles like this:

    • 14.9 GB NTFS partition covering 88% of the 17 GB drive and beginning at 11%
    • 2 GB NTFS partition covering 11% of the 17 GB drive and beginning at 0% (start of drive)

    We see, there is a 2 GB partition, followed by a 14.9 GB partition. In its list, GetDataBack gives preference to the larger one. If you want to recover files from the smaller partition, which is the first partition, you need to select the second tile.

    Sometimes the file system list can contain a confusing number of entries. If the first entry does not yield what you are looking for, you need to examine the entries in greater detail. Look for a file system that comes closest to the type, size, and position of the partition you lost.

  6. Other means of improving the quality of the recovery:

    • Check Duplicates in the Recovery Tree to bring up different versions of files with the same filename, as this might uncover files otherwise suppressed.

    • Only check Deleted if you want to recover files deleted with Windows Explorer or by emptying the Recycle Bin.

    • Increase the sophistication level.

See also: FAQ, Support, Doing a Data Recovery, Sophistication level


FAQ

Frequently Asked Questions

Can fragmentation of the disk affect the results of the recovery?
Can I investigate the quality of my recovered files before I buy the software?
Can I use GetDataBack to recover data from CDs, CDRs, and DVDs?
Can I use GetDataBack to recover data if the BIOS of my computer does not recognize my hard drive?
During the scan with GetDataBack I receive a disk error. What does this mean?
After the scan, GetDataBack reports "No file system found". Why?
How can I optimize the quality of the recovery?
I do not find certain files in the recovery; how do I get these?
I cannot open the recovered files. Why?
I don't know which file system I had on my drive before it crashed. What shall I do?
Is it safe to run GetDataBack for my crashed hard drive?
How do I recover data from a laptop or notebook drive?
Will GetDataBack work on a hard drive larger than 2 TB?
How do I recover deleted files?
How do I recover encrypted drives?
How do I recover encrypted files?
How do I recover a RAID?
How do I recover files from a network drive?
How do I recover a NAS (Network Attached Storage) device?
Why don't I see my drive after starting GetDataBack?
What is your update policy?
Can I use DD images in GetDataBack?
Does GetDataBack support Unicode character sets?
Why can I not copy the recovered files to a network drive?
Can I reuse a drive after I recovered my data from it?
How do I recover a drive from a Virtual Machine?
How do I interpret the status line?
Can fragmentation of the disk affect the results of the recovery?
It depends. Fragmentation in NTFS should not affect the recovery results, as information about a file's allocation is stored in an MFT entry. In FAT file systems, this information is stored in the FAT, leaving the recovery program with only the entry point of the data if that FAT is missing. Fragmentation can ruin the day here. EXT, HFS+, and APFS are not affected in the sense that if a file can be found, its allocation comes along with it. That means, if the file shows up in the Recovery Tree, it should be recoverable. If it does not contain the expected data, you should review your selection in the Select File System screen.
Can I investigate the quality of my recovered files before I buy the software?
Yes, GetDataBack contains a build-in viewer, which lets you investigate the quality of your files. You can also open the files with their original application without having to buy the program.
Can I use GetDataBack to recover data from CDs, CDRs, and DVDs?
No, GetDataBack recovers from hard drives, SSD drives, floppies, USB drives, SD cards, Flash drives, and Images, but it is not suitable for restoring data from optical media.
Can I use GetDataBack to recover data if the BIOS of my computer does not recognize my hard drive?
No, if the BIOS does not recognize the hard drive, our software is not able to perform a recovery. Please make sure that the connections, jumper settings, and controllers are ok. If the hard drive is still not recognized, try to connect it to another computer and see if it gets recognized there. If your drive is a USB drive, remove it from its enclosure and attach it directly to the internal SATA cable.
During the scan with GetDataBack, I receive a disk error. What does this mean?
A disk error is a sign of a hardware problem. It might be better to make a disk image first, as every attempt to access data can increase corruption. After successfully creating an image, you can use the image file as an input for GetDataBack. It can also be appropriate to continue and ignore the error, especially if you scan the drive with a low sophistication level, and intend to recover only a couple of files.
After the scan, GetDataBack reports "No file system found". Why?
  1. The drive might be encrypted, thwarting any recovery attempts.
  2. It might be too damaged to read any valuable data from it.
  3. It contains a file system that is not supported.
  4. It contains a supported file system, but this file system is unchecked in the settings.
How can I optimize the quality of the recovery?
In the Select File System screen, be sure to choose the file system which contains the most applicable information about the partition you are trying to bring back. If none of the entries resemble that partition, increase the sophistication level. Before you buy a license key, please test enough files to ensure you are satisfied with the recovery results.
If you are just concerned about some individual files, try checking Duplicates in the Recovery Tree. That might bring up different versions of the files.
See also our comprehensive Checklist.
I do not find certain files in the recovery; how do I get these?
Do a Search for your files for a chance to find them even in some hidden subdirectory.
Check the recommendations in How can I optimize the quality of the recovery? as well as our comprehensive Checklist.
I cannot open the recovered files. Why?
There are two possible reasons for the inability to open the recovered file:
  1. New data overwrote your files. In this case, there is no way to retrieve the files.
  2. The second possible reason is that you have chosen the wrong file system entry in the Select File System screen. Be sure to choose the file system that contains the most applicable information about the partition you want to recover. Try other entries from that list.
See also our comprehensive Checklist.
I don't know which file system I had on my drive before it crashed. What shall I do?
GetDataBack Pro supports all Windows file systems and most Apple and Linux file systems, so you can probably proceed. GetDataBack Pro automatically recognizes the file system.
Is it safe to run GetDataBack for my crashed hard drive?
As long as your drive does not have a physical problem, it is safe to use GetDataBack. The program does not change anything on the crashed drive, as it is a read-only software. Install the software on a working Windows computer and attach the hard drive, which contains the lost files, as a second hard drive to this computer. Make sure that the BIOS recognizes this hard drive.
If, however, GetDataBack reports read errors, you should pause and consider your options: One is to send the drive to a recovery lab. Another one is to create an image of the "bad drive" first and run GetDataBack for this image in the next step. Another option is to ignore the error and continue, which might be acceptable if you are scanning the drive with a low sophistication level and intend to recover only a handful of files.
How do I recover data from a laptop or notebook drive?
One option is to remove the drive from the laptop and connect it to the SATA cable of a desktop computer. Another option is to create a WinPE boot medium and run the recovery software from there. You can find instructions on how to create a boot CD or USB stick on our website at http://www.runtime.org/peb.htm. Keep in mind that you still need enough space on a different drive to copy the recovered files.
Will GetDataBack work on a hard drive larger than 2 TB?
Yes, GetDataBack works on hard drives of any size. Keep in mind that your computer, its BIOS, the hard drive controller, and the operating system (Windows) must support the size of your drive too. This support might be a concern if you try to recover data from a modern large drive on a machine that is a couple of years old.
How do I recover deleted files?
In the Recovery Tree screen, check the Deleted checkbox. Use the Search feature to find the files as they might be tucked away in some subdirectory. The outlook for a successful recovery of deleted files very much depends on the file system and the circumstances. It also matters how long you continued working with the drive after you deleted the files.
In Windows (NTFS, FAT), "Permanently deleted" files can be found in their original directory (if still available). Files from "emptied recycle bins" can be found below the RECYCLE directory. Note that these files have lost their original filenames, but still have their original extensions.
In Linux EXT and Apple HFS+ partitions, GetDataBack is not suitable for the recovery of deleted files, as the operating system removes the allocation information. Files can be undeleted using the file system journal, though, if enabled. Look out for un-deleters that examine the file system journal to recover deleted files.
Apple APFS makes the recovery of deleted files simple, as it regularly creates "checkpoints". In GetDataBack, you can access into the APFS file system through these checkpoints, and find deleted files.
How do I recover encrypted drives?
Third-party software-encrypted drives behave transparently, once they have been unlocked. That means you can run GetDataBack on them as you would on a regular drive. It might be helpful first to image the unlocked volume, and later run GetDataBack for this image.
Some USB drives (WD) are hardware-encrypted with the encryptor build into the USB controller. The good news is, most of these controllers use the same key.
How do I recover encrypted files?
The short answer is you can't. By design, you can not recover encrypted files without knowledge of the decryption key. If you do know that key, however, recovery might be possible, depending on the file system and the circumstances, but is beyond the scope of GetDataBack.
How do I recover a RAID?
If you can still access the RAID volume (this is the combined RAID, not the members), you can scan it like a regular drive. If the RAID is not accessible or broken, you need to "de-stripe" it first. Use RAID Reconstructor for this. It generates a VIM file (Virtual Image) that, together with the member drives, you can run GetDataBack on.
How do I recover files from a network drive?
That is not possible directly. You must take the network drive offline and attach it physically to the machine running GetDataBack. It must be a single drive with a supported file system. If the network drive internally consists of several drives, see the next question.
How do I recover a NAS (Network Attached Storage) device?
You can not recover data from a NAS over the network. For GetDataBack to work, the drive or drives must be locally and physically present at the computer running GetDataBack. The file system on the NAS must be supported. If the NAS consists of more than one drive, you need to run RAID Reconstructor first, to obtain a VIM file (Virtual Image).
Why don't I see my drive after starting GetDataBack?
Make sure the drive is connected correctly, and the BIOS detecting it. If it is a USB drive, attach it directly to the internal SATA cable.
What is your update policy?
Updates of GetDataBack are always free for licensed users. You can download the latest version on our website and activate it with your license key.
Can I use DD images in GetDataBack?
Yes, you can create Linux DD images that are compatible with GetDataBack. For example, the following command would create an image in the user's home directory:
   dd if=/dev/hda of=~/hdadisk.img bs=4K conv=noerror,sync
Make sure you include the conv=noerror,sync options, so the image does not stop on read errors, and the offsets are preserved.
Does GetDataBack support Unicode character sets?
Yes, it does. You can recover files whose names are encoded in non-standard character sets. These include all Unicode character sets, such as Japanese, Chinese, Korean, Russian, Greek, etc.
Why can I not copy the recovered files to a network drive?
Please map the network drive to a drive letter. If you still can not copy to the network drive, check this.
Can I reuse a drive after I recovered my data from it?
You should not, as it can not be trusted any longer, unless you know precisely your data loss was not caused by physical problems with this drive.
Another reason is, you might need to come back to the old drive, in case you miss some files in the recovery or the recovered files turn out to be corrupt.
How do I recover a drive from a Virtual Machine?
Start a VM running Windows. Inside the VM install GetDataBack Pro. Shut down the VM and attach the drive you want to recover data from in the VM control panel, as well as a drive to hold the recovered files. Then run GetDataBack within the Virtual Machine.
How do I interpret the status line?
The status line gives you information about the ongoing data recovery, more...

See also: Doing a Data Recovery, Create image, Image


Read Error

A disk or read error is a sign of a hardware problem. The drive has bad sectors that the program can not read.

Consider creating a disk image of the problem drive first. Every attempt to access data can increase corruption, or can cause the damaged drive to fail entirely. After successfully creating an image, you can use the image file as an input for GetDataBack.

Creating an image is often preferable to simply plowing through. During the image creation, the program reads every sector exactly once, while the recovery process might read some areas several times. On the other hand, scanning the drive with a low sophistication level might leave broad areas untouched, thus actually reducing the stress compared to creating an image. This consideration especially applies if you are looking for only a couple of files. Please read a discussion on this topic.

In the end, this is your data and your call. You might also consider stopping the recovery attempt altogether and shipping the drive to a lab.

Error Message

This message is displayed if the program encounters an error reading from a drive. This error is not recoverable, but you can ignore it.

You have the following choices:

  • Ignore: The error is ignored, and the operation continues.
  • Ignore all: The error is ignored, and the operation continues. Future errors are suppressed and ignored as well; the program will not prompt this message again. This condition is canceled at the next regular prompt for a user input.
  • Cancel: The program cancels the current scan or other process and returns to the previous status.

Bad Sector Handling

GetDataBack reads data from the hard drive in blocks of 64 sectors (32 KB). If the read operation fails, and before the program reports the error, it can Retry the operation for each sector or skip the entire block. Auto lets the program pick the approach. It is almost always advisable to skip the block. Doing otherwise puts stress on the damaged drive with usually no benefits. You can choose the strategy in Tools->Settings->Data Recovery->Bad sectors.

See also: Create image, Image, Sophistication level


Support

Self-help resources

Doing a Data Recovery | Article about a typical data recovery, from setting up the recovery computer, running GetDataBack, to copying files to a safe medium.
Checklist | A list of actions you can take if your recovered files are corrupted.
Quality | Check the quality of the recovery
FAQ | A GetDataBack FAQ
Step-by-Step | Online PDF with step-by-step instructions (external)
Create image | Instructions on creating an image of a drive
Snapshot | How to create a snapshot for customer support
Log file | How to create a log file for customer support
Audit | How to create an audit file for customer support
Status line | Status line legend

Contact

USA
Phone: | 1-888-777-6960
Fax: | 1-818-475-1741
Email: | support@runtime.org
Website: | http://www.runtime.org

Europe (Germany)
Phone: | +49-30-2180 1016
Fax: | +49-30-690 88 444
Email: | support_europe@runtime.org
Website: | http://www.runtime.org

If you have any questions related to the use of this software, please send us an email. We usually answer emails on the same day. It is a good idea to include a snapshot of the recovery with your support request.

See also: FAQ, Doing a Data Recovery, Checklist, Snapshot, License key

<< Introduction [Select Drive > Select File System > Recovery Tree] Settings Menu Support Glossary >>


Status Line

The status line on the bottom of the screen gives you information about the ongoing recovery process.

Mem: 16309MB tot / 8092MB avl / 1581MB prc || C | DISK0 954 GB L1 FSL5 NTFS 953 GB@S796,672 158932 dirs/1153829 files/912 GB/1312762 dhs
Legend:
Memory
16309MB tot | Installed total physical memory
8092MB avl | Immediately available physical memory
1581MB prc | Memory used by this process
License status
Flags
X | Extented options active (CTRL-U F F)
C | Code viewer on (debug only)
Lo1 | Logging is on, log file is kept open (vs closed), errorlevel is 1
A | Audit is on
Drive
DISK0 | Selected drive
954 GB | Drive capacity
File system
L1 | Current sophistication level
FSL5 | File system list has 5 entries
Selected file system
NTFS | Type (NTFS, FAT, FAT32, exFAT, EXT, HFS+, or APFS)
953 GB | File system capacity
@S796,672 | Located at sector 796,672
Recovery Tree
158932 dirs | # directories in Recovery Tree
1153829 files | # files in Recovery Tree
912 GB | Total amount of data in Recovery Tree
1312762 dhs | # dirhash entries (internal)


Audit

An Audit is a technical support option that collects drive data to reproduce an error. The Audit maintains a list of all sectors read. After GetDataBack hits the error, the program extracts these read sectors. Create an Audit only if Runtime Software's support is requesting one.

  1. Immediately after starting GetDataBack, go to TOOLS->Settings->Miscellaneous->Debug and enable the Audit drive access.
  2. Proceed with the data recovery until you reach the point at which the error occurred.
  3. Go to HELP->Print Audit.
  4. Underneath Create compressed image file, you see the total amount of data to be extracted. Verify the file is not too large and fits on the destination.
  5. Click Create compressed image file.
  6. Select a name for the file. Make sure the file you are creating is not on the drive you want to recover.

This process can take a while. Once it has completed, contact technical support for instructions on what to do with this file.

See also: Snapshot, Log file, FAQ, Doing a Data Recovery


Log File

The log file allows you to review what information was collected during the recovery process. The program records every step it takes in the log file: selection of the drive, selection of the file system, creation of the recovery tree.

The log file records information about the geometry of the selected drive, file system structures such as partition tables, boot records, supqerblocks, and metadata, the quality of the file systems found by the program, the sector numbers and found file signatures, the filenames associated with located files, the location of directory starts, and the copy process.

The log file can consume quite an amount of storage space. Should you decide to keep a log file of the recovery, choose a log filename in Settings. ***Make sure you do not write the log to the drive you want to recover***

You can create a short version of this log file with the snapshot feature.

See also: Snapshot, Audit, Support


Snapshot

The snapshot summarizes the recovery process for support purposes. It records your settings and choices. It is a short form of the log file, but is only a couple of KB in size.

To create a snapshot, click Help->Snapshot for customer support. The program asks for a filename and location to store this file. (Caution: Do not specify a location on the drive you want to recover). It is a good idea to include the snapshot when you send us an email for support.

See also: Log file, Audit, Support


Create Image

Creating an Image File

Clicking Tools->Create single image file allows you to create an image of a single hard drive. That is usually recommended if there are bad sectors on the drive.

Select the drive you want to copy from and the file you want to copy to. You can pick any drive represented by a tile in the Select Drive screen, even other image files or Virtual Image files.

Checking Multi file splits the image into files of 650 MB. Assume you name the image "untitled.img", the segments will be named untitled.img, untitled.001, untitled.002, ..., untitled.999, untitled.a00, untitled.a01, etc. The last segment is always smaller, signaling the end.

Checking Compressed compresses the image. There are two compression levels, Fast and Good. Do not use compression if you create an image because of bad sectors on the source drive. This is not the time for that. Also, if the "bad drive" fails during the process, having an uncompressed image leaves you with some data, while a compressed image might turn out corrupted.

Make sure the target drive has sufficient space to hold the image file. Click Start to begin creating the image. Once you have created the image, you can use it in Runtime's data recovery products like a real drive. The imaging process counts the read errors it encounters. Make a note of that number, as well as the percentage of data read. The program fills unsuccessfully read sectors with 0's in the image.

See also: Drives, Image Files, Virtual Images, Read errors