TOC · Work · Menu · Tools

## Data Recovery

Damaged Devices Removed Files Errors in Files Encrypted Files Complex Scan

Attention! Make sure the device is not damaged beforehand (if device is damaged).

Attention! Do not write anything to the source disk. Recover data to another disk only. It is highly recommended to recover data to another physical device. You may recover to another partition of the same device only if you are sure that the source and destination partitions don't overlap and the device has no physical problems. Do not load system or run software from the partition where lost data is located (Installation and Run).

Attention! If files are recovered incorrectly or there are other problems make sure you are using the most recent software versions from a trusted source.

### Data Recovery Steps

- Find and open a volume containing lost data;
- open/reopen the virtual directory [All Found / Virtual FS] to get more or less found files (see virtual FS Reconstruction);
- mark items for recovery and use the menu Tools · Recover to recover them to another disk.

With Free Edition you may recover up to 4000 files from the opened panel per single command call (you should first open a directory with the necessary files on a panel and then select recovery from the panel).

If you cannot open/play files after recovery you should try different found volume variants - return to the Full Scan results or to Partitions and open the next found volume.

### Dialog Box "Recover"

#### File Categories

Select file categories for recovery - see File Panel icons for categories details. Checkboxes for excluded files will be unchecked unless the option "keep selection marks for excluded items" is used.

#### Button "Size"

Calculate the size of the data to recover. Global indicator of recovery process is working if the size is calculated. You should not calculate the size to avoid unnecessary device load on devices with bad sectors.

#### Button "List" · File List

Create a list of selected files with their attributes.

#### Button "List" · Sector List

Obtain a list of sectors occupied by selected files (e.g. it may be used by a different software to create a partial disk clone). It is possible to report fragments boundaries in sectors or in bytes, and to specify file paths in the list.

The option Sector ranges allows listing only those files fragments which are located in the specified sector ranges. E.g. this allows obtaining a list of damaged files located in bad sectors when you recover from the image file (or from a healthy cloned disk) which does not report source bad sectors itself. If you created an image/clone using the function Copy sectors with the log file enabled then you can export a list of bad and skipped sectors from the log by using a command in Copy sectors Menu.

Data recovery restrictions are applied on a number of files and subdirectory processing if Free Edition is used. Alternatively, you can use the Cluster Map report without restrictions, in this case the lists will also be sorted by the position of the fragments on the disk.

#### Checkbox "Include NTFS altstreams" (Professional Edition only)

Recover NTFS alternate data streams. Alt. streams are displayed in the File Panel after FS reconstruction, an alt. stream name is separated by a colon.

#### Filters

Filtering by a name mask, size, modification date, ID is supported. Checkboxes for excluded files will be unchecked unless the option "keep selection marks for excluded items" is used. Use 0 (zero) as a second value for the size/ID if you need not to limit the higher value for the size/ID.

Name masks are semicolon separated. Wildcards "*" (any set of chars) and "?" (any char) are supported. Exclusion masks may also be defined by prepending a backslash "\". Masks at the beginning have a priority. E.g. the name abc.tmp matches a*;\*.tmp and does not match \*.tmp;a*.

If the option Process only directories with files is used than directories will be recovered which contain files matching filters.

#### Create Report (Professional Edition only)

Save recovery report to a file (file name and other parameters are requested on recovery process start). Files and directories are listed, I/O errors for files are reported, checksums CRC-32, MD5, SHA-1, SHA-256 are calculated for a forensic report.

### Additional Options

#### Checkbox "Unicode names"

The option is marked or used by default if an OS supports Unicode names. Without Unicode support symbols outside the selected code page will be transliterated or substituted (see Locales). Unavailable in DOS.

#### Recover to a FAT formatted volume, checkbox "Split large files"

FAT volumes do not support files greater than 4GB (or sometimes 2GB). Larger files may be split during recovery upon a request if OS is properly reporting this (which is not always the case) or if the option Split large files is used (recommended for FAT). Later you may merge file parts on another disk by using the system utility copy /b, for example. Pure DOS supports only FAT volumes.

#### File names in DOS, checkbox "Substitute names"

Without special drivers long files names are not supported in DOS. With the option Substitute names names are substituted during recovery. File LRENAME.BAT is being created in the destination directory for backward renaming. To restore original file names load OS Windows, open the destination directory and run the file LRENAME.BAT.

With the option utf-8 the file LRENAME.BAT will be created in the utf-8 format fully supporting Unicode. Utf-8 format is supported in Windows 7 and higher. Without the utf-8 option the OEM code page will be used and Unicode symbols outside the selected code page will be transliterated or substituted.

#### Paths longer than 259 symbols (Windows NT and higher)

Support for extra long paths option (or manual prepending the prefix \\?\ when specifying the destination directory, e.g.: \\?\D:\) allows recovering paths longer than 259 symbols. Such long paths may be inaccessible using standard OS means such as Explorer ("My Computer").

#### Duplicate Names, Errors in Files, and Other Events Handling

During recovery there may be name duplicates if there are different versions of the same file/directory (or different links), or directories are merged wrongly, or the destination file system doesn't distinguish between some names (case insensitivity), or there are already files in the destination directory before recovery. You need to specify what to do in such case.

The options rename, auto rename, skip/all, merge/all (for directories) are available. Additionally you are asked for a threshold (maximum number of duplicates for the same name). When the threshold is exceeded you are asked again for a desired action. Duplicates are not handled if name substitution is used in DOS.

During recovery there may I/O errors and FS errors which obviously result in errors in affected files. You can also specify how to handle such files:
Skip to skip a file with such errors (the skipped file will remain marked after recovery),
Ignore to continue recovery with errors,
Ignore and Hide to continue recovery and hide a file (set the attribute "Hidden" in Windows / DOS, and set zero 0 permissions in Linux / macOS).
Move to $Bad to move the file to the directory $Bad within the destination directory.

You can specify handlers during the recovery or before recovery using the option Event Handler. As well you may change the destination, split the file if there is no more space on the destination.

### NTFS Encrypted Recovery

DMDE recovers NTFS encrypted files without decryption. An encrypted file contains the encrypted data and encryption key which in its turn is encrypted with a certificate key. You need the certificate from the source OS or its backup to be installed on a destination OS to open encrypted files after recovery. Please refer to Microsoft documentation on exporting and importing certificates.

To store encrypted files NTFS encryption (EFS) must be supported by both OS and the destination file system (i.e. Windows and NTFS are required). In DMDE there are workaround options for EFS recovery when run on a different platform.

Recover to separate streams: recover data streams and keys into separate files (.efs and .efk extensions are assigned). Further processing of these files is a user task.
Recover to backup (portable format): recover file data and key into a backup file (.efb). Backup files may later be restored into EFS files using the menu Tools - Restore EFS from Backup... (only when run on a EFS supporting platform).
Recover to NTFS encrypted file: recover at once into an encrypted NTFS file when run on a EFS supporting platform.