Introduction

GetDataBack for NTFS © 2001, 02, 03 by Runtime Software LLC

1601 Fairview Drive, Suite H, Carson City, NV 89701, USA
Phone (USA): 1-775-884-3922, Fax: 1-818-475-1741
Phone (Germany): +49-30-280 8008
Email: info@runtime.org , Web: http://www.runtime.org

GetDataBack will help you retrieve your files if the hard drive's partition table, boot record, MFT, or root directory have been damaged by a virus, accidental deletion, formatting, fdisk or power failure.

GetDataBack can even recover your data when the drive is no longer recognized by Windows. It can likewise be used even if all MFT information is missing.

Advanced algorithms will make sure that all files and directories are put together as they were. GetDataBack works on a partition level. It restores one partition at a time.

GetDataBack is safe. It is read-only, meaning the program will never attempt to write to the drive you are about to recover. Note: If you are going to perform a recovery, DO NOT install the software on the drive you want to recover. Instead, install it on a different drive and connect this to the machine as the second drive!

GetDataBack enables the regular user to conduct his own data recovery by guiding him through five easy to understand steps, thus gives the advanced user the possibility to interfere with the recovery and improve the results, by examining the scan log, the file system details, file and directory information, by selecting the sector range to be scanned, by choosing excessive search for file systems or search for lost files, by calling Runtime' s DiskExplorer.

GetDataBack recovers data from

  • Hard Drives
  • Partitions
  • Floppy Drives
  • Drive Images
  • Zip/Jaz Drives
  • Remote drives through a serial cable or TCP/IP

This version of GetDataBack recovers NT file systems, as used by Windows NT and Windows XP.

This program runs under these operating systems: Windows 95/98/ME, Windows NT, 2000, XP.

If you want to recover an FAT partition, check out our GetDataBack for FAT at http://www.runtime.org/gdb.htm.

If you have any questions about this software, check out out F.A.Q. or contact our support!

See also: Doing a recovery, F.A.Q., Support, Check List


Installation

Do not install GetDataBack to the drive you want to recover! It is strongly recommended to proceed as follows:

Install the program to another computer, which doesn't have any problems. If you have a choice, choose the computer which has the most RAM and is the fastest. Attach the drive you want to recover as a slave to this machine. Make sure the drive is jumpered correctly and is recognized by the BIOS.

After downloading GetDataBack run the setup.exe. The setup wizard will guide you through the installation process.

See also: Do a data recovery


System Requirements

  • Pentium processor
  • 32-128 MB RAM (depending on the capacity of the drive you want to recover)
  • Windows 95/98/ME, Windows NT, 2000, XP

For best results choose your fastest, most RAM-loaded computer and attach the drive you want to recover to this machine.

See also: Installation, Do a Data Recovery


GDB

GDBNT.INI

This file contains some definitions for GetDataBack's recovery engine:

  • The LostFiles section contains file definitions for the Recover Lost Files feature.


Version Info

This windows displays version numbers and dates of the following program components:

  • Product name is this software's name.
  • Version is the current version number.
  • Program name is the name of the EXE file.
  • Program file date is the date of the EXE file.
  • DRV16 location is the directory where DRV16 is located. This file is the driver for accessing the hard drives and is required for Windows 95/98/ME.
  • DRV16 version is the hard drive driver's version number.
  • DRV16 date is the hard drive driver's date.
  • Help file is the name of this help file.
  • Installation dir is the directory this software is installed.
  • INI file is the name of this software's INI file.


Menu structure

File |  |
 | Load recovery | load a previous scan or recovery tree
 | Save recovery | save a scan or a recovery tree
 | Exit | quit this program
Recovery |  |
 | Copy... | copy recovered files or folders to a safe destination
 | Open | open a file with its native application
 | Open with... | select an application to open a file with
 | Show info... | show information about the recovery details of a file
 | View | view a file with the internal viewer
Tools |  |
 | Search files... | search for files in the recovery tree
 | Search next | continue last search
 | Call DiskExplorer | call Runtime's DiskExplorer for the currently selected structure
 | Create Image File... | clone the currently selected drive or partition
 | Show data structures | show data structures used by GetDataBack (internal use)
 | Options... | change recovery settings
Help |  |
 | Content | call the integrated help (this)
 | Register | enter a license key to unleash the full power of this software
 | About | displays copyright, license and version information
 | Version info | displays more version information


Registration

Registering the software will enable you to copy your recovered files and folders to a safe location.

Register online on our website http://www.runtime.org and get the registration key immediately.

If you prefer not to order online give us a call at 1-775-884-3922 (USA) or +49-30-280 8008 (Germany).

Entering the License Key

When entering the license make sure you enter both, the name and the license key, exactly as spelled in the registration email Runtime sent to you. Name and key are related and only entering both will successfully register GetDataBack. We recommend to copy and paste the information from the registration email.


License Agreement

License Agreement and Disclaimer

The following are the conditions under which Runtime Software software is sold, supported and may be used. By using or registering Runtime Software software, you are agreeing to these.
This document may be augmented or superceded by conditions included with specific applications.

Neither the author(s) nor Runtime Software assume responsibility for any expense, damage or loss caused by your use of this software, however it occurs.
All the registered trademarks used herein are registered to whoever it is that owns them. This notification is given in lieu of any specific list of trademarks and their owners.

If you register software by Runtime Software, we will assume that you are doing so having tested the shareware version and ascertained that it's suitable for your hardware and requirements. We cannot provide refunds for shareware registration if you subsequently change your mind.

No portion of the documentation for this software or any of its attendant files may be reproduced in whole or in part in any medium or form of transmission exclusive of the archive file for the software without the express written permission of Runtime Software. You may not modify or patch the software's executable files in any way, including but not limited to decompiling, disassembling, or otherwise reverse engineering the program.

Registering this software buys you a single-user license to use it in perpetuity, subject to the terms discussed herein. This means that your registered software can only be used by one person at a time. A single-user license does not permit you to make the registered software available over a network for multiple users to access, to distribute it in any form or to provide it in conjunction with any other product without the express written permission of Runtime Software. If you have any questions about the software license, feel free to get in touch with us.

If you have downloaded this software or had it given to you on disk to try out, you are allowed to use the limited version of the software for free, in order to use the full version you have to register the software immediately.

You may distribute the software (on CD-ROMs, Books, Catalogs, Internet etc.) as long as you follow each and every one of the following:

1. You distribute only exact, unmodified copies of the original unregistered shareware version of the software incl. the DISCLAIMER.
2. You do not monetarily charge or otherwise request any compensation for any copy, however made, without prior permission from Runtime Software.
3. You include the phrase "Copyright by Runtime Software" with any copy of the software.


Glossary

Attributes

Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume. See: Step 5.
In NTFS attributes are structures entirely describing a file (see: NT Attributes).

Boot record

A Boot record is a special sector describing the file system following this sector.

Cloning a drive

Making an exact sector-by-sector image of a drive. This is recommended when you want to perform a data recovery on a drive that has physical damage (bad sectors). With the image you can work as you could work with the original drive.

Cluster

A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors.

Cluster region

This term is meant to refer to the area of the file system that is addressable by a cluster number. These are - in a FAT file system - the sectors following the Boot record, the FATs and the Root Directory (FAT12, FAT16 only).

Data recovery

The process of retrieving files from a drive that cannot be accessed from its operating system anymore.

Deleted file

A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with xE5 and by releasing the FAT entries of the clusters it used. In NTFS a file is deleted by marking its reference in the MFT as unused. Change the Options if you want to include deleted files in the recovery.

Directory

In a FAT file system a directory is a list of directory entries. In NTFS a directory is a list of Index Entries.

FAT file system

Name of a file system using a "file allocation table". Introduced with DOS and used in all Windows versions. If you want to recover a FAT partition, check out our GetDataBack for FAT at http://www.runtime.org/gdb.htm.

File Entry (MFT entry)

A file entry in NTFS is an entry in the MFT.

File system

The file system (such as FAT or NTFS) is the scheme how a file is store on a disk. Do not confuse it with the operating system (such as Windows95 or WindowsNT).

Hexadecimal

The hexadecimal system is based on the number 16, other than the decimal system which is based on 10. The supplemental digits are A, B, C, D, E and F. Example: hex AA = dec 170. (10*16 + 10*1).

Image File

An image file is a sector-by-sector copy of a drive. It can be used as a source for GetDataBack.

Index Allocation

An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of file names establishing a directory.

LFN

NTFS uses attributes to store the LFN (long file name).

Logical Drive

Logical drives are drive like A:, B:, C:, ... They are accessed using the according operation system routines.

Lost File

Lost files are files without any directory information left.

Media Descriptor

Flag byte in the boot record and the beginning of a FAT describing the kind of drive. Usually xF8 for hard drives.

MFT (Master File Table)

The MFT is a database containing information about every file or directory on a NTFS volume. An entry is called MFT entry or file entry.

MFT Number

The MFT number is the position of a file entry within the MFT.

Non-resident Attribute

see: NT Attributes

NTFS

File system introduced with WindowsNT, used by Windows NT, Windows 2000 and Windows XP.

NT Attributes

The NT Attributes describe every aspect of a file in NTFS, such as file names, time stamps, file sizes, data allocations and more:

Number | Name | Description
$10 | Standard information | contains time stamps and DOS attributes
$30 | File name | contains the file's name for different name spaces (usually NT's native Unicode file name and DOS compatible DOS file name)
$80 | Data | if the entry represents a file, this attribute contains the file's data
$90 | Index root | if the entry is a directory, this attribute describes the root of a binary tree in which the directory entries are located
$A0 | Index allocation | if the entry is a directory, this attribute contains a list of file names

NT Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry. Non-resident attributes are store outside using run lists.

Partition

A partition is a continuous region on a physical drive. It is usually interpreted by the operating system as a logical drive.

Partition Entry

A partition entry describes type, location and size of a partition.

Partition Table

The partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive.

Physical Drive

Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.

Recovery Tree

Explorer-style view displaying all recovered files and folders. See Step 5, Load and Save Recovery.

Resident Attribute

see: NT Attributes

Root Directory

In NTFS the root directory is described by the index buffer of MFT entry #5.

Scan

A scan is the process of examining every single sector of a drive. See Step 3, Load and Save Recovery.

Sector

A Sector is the smallest unit that can be accessed on a drive. The size of a sector is always 512 bytes. Multiple sectors are grouped to "clusters".

Sectors Per Cluster

This term describes the cluster size the file system is using. It is essential for translating a cluster number into a physical sector number.

Run List

A run list is a list of clusters used for an NT Attribute. If the attributes are too large to fit into the MFT entry, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list.


Prepare a Recovery

Doing a Data Recovery

The following describes a typical data recovery:

  1. Install GetDataBack on a healthy Windows machine without the drive attached you want to recover from. Make sure you have sufficient space on the "good drive" for storing the recovered data. You also can store the recovered data to a LAN if have access to one. The machine you are running GetDataBack on can have any of the following operating systems: Windows95/98/ME, Windows NT, W2K, Windows XP.

  2. Shut down the computer and attach the drive you want to recover from ("bad drive") as a 2nd drive. You might need to jumper it differently. Make sure it is recognized correctly by the BIOS when starting up the computer.

  3. Start GetDataBack and verify that HD128: is the "good drive" and HD129: is the "bad drive". Perform Step 1 to 5 of the recovery process for the "bad drive" HD129:. Please follow the instructions provided with the particular steps.

  4. When Step 5 completed and you are ready to copy the recovered files over to the "good drive", you need to purchase a license code if you have not already done so. Do not quit GetDataBack for purchasing or entering the license code, just enter the code and continue with copying the files. It is a good idea to start with the files you need most.

  5. After copying all desired files shut down the computer and remove the "bad drive". Store the "bad drive" at a safe location.

  6. It is recommended to build a brand new system now. Use components other than the "bad drive". Install the operating system. Install the programs from their installation cd-roms. Finally import the recovered data to the new drive.

  7. Verify you got back all the data you need. Do not recycle the "bad drive" before you are absolutely sure about this. It is a good idea to wait 4 weeks before re-using the "bad drive". If the "bad drive" had any mechanical problems you definitely must not use it again.

If you notice any mechanical problems with the drive, such as bad sectors or unusual noise, you should stop the recovery and make a drive image first. When successfully created, you can recover from this drive image as you would recover from the original drive. A mechanically damaged drive can fail entirely every second. It must be your primary goal to pull all raw data off such a drive as fast as possible. Making an image also reduces the load on the drive because each sector is read only once. Professional data recovery companies always make an image of the drive before trying to retrieve any files.

If you divert from the process described above, make always sure you

  • never install GetDataBack on the "bad drive",
  • never use the "bad drive" as the boot-up system drive (C:),
  • do not have temporary files and folders use the "bad drive",
  • never copy the recovered files to the "bad drive",
  • make an image first if the "bad drive" has mechanical problems.

GetDataBack gives you lots of options: You can recover from the actual hard drive, from image files or even from remote drives over a serial cable or TCP/IP. You even can recover over the Internet.

See also: F.A.Q., Support, Check List


Step 1

Step 1: Scan for drives

The first screen displays a list of drives and devices, which are possibly accessible. Check as many drives as you wish.

You can uncheck one or more drives, if you want to omit them. This might be necessary if a complete drive lookup causes your computer to crash.

However, include at least the drive you want to recover.

On the right side of the screen you can define the default temp directory and where the log file of the recovery will be saved - if you want one.

Press Next to start searching for accessible drives.

See also: Drives


Log File

The log file gives you the opportunity to relive what happened to your drive during the recovery process. Every step the program takes is recorded in the log file: the scan for available drives, selection of the source, the selection of the file system and sector range, the scan of the drive, the selection of file systems found and the creation of the recovery tree.

The file states information about the geometry of the selected drive and/or partition, the quality of the file systems found by the program, the sector number and first 8 bytes of found files, the file names associated with located files, the location of directory starts, and the copy process.

In a large recovery the log file can consume quite an amount of storage space. Should you decide to keep a log file of the recovery choose a log file name in Step 1.


Step 2

Step 2: Select Source

In Step 2 the accessible drives and devices will be displayed, depending on what you chose in the first step. The left side displays the entries you need to select from. The right side contains additional information about the data source selected on the left side (e.g. the geometry and the number of sectors).

Which entry to choose?

You now must select the appropriate entry from that list. Since GetDataBack performs recovery on a partition level the general rule is:

Select an entry that completely contains the partition you want to recover. The chosen entry must not be a subset of this partition. It must be a superset instead. Selecting an entry significantly larger than the partition is allowed, but will slow down the recovery process and might cause confusing entries in Step 4.

You should prefer physical drives over logical drives, because logical drives are already interpreted by the operating system. Very often you don't even see a logical drive that might contain the data you want to recover. Physical drives provide the most undisturbed low-level access to the raw data of the drive.

Examples:

You want to recover: Select this entry:
2nd drive that contained one partition 2nd hard drive (HD129:)
1st partition of 2nd drive (40GB) containing 4 partitions with 10GB each. The tree is looking like this:

(1) 2nd hard drive 40000MB (HD129:)
(2) + 1st partition (NTFS) 10000MB
(3) + 2nd partition (DOS Extended) 30000MB
(4) + 1st partition (NTFS) 10000MB
(5) + 2nd partition (DOS Extended) 10000MB
(6) + 1st partition (NTFS) 10000MB
(7) + 2nd partition (DOS Extended) 10000MB
(8) + 1st partition (NTFS) 10000MB

Entry (2) is the entry you should choose.

If you want to recover other partitions as well, select entry (4) for the 2nd partition, entry (6) for the 3rd partition and entry (8) for the 4th partition.

You also can select entry (1) and all 4 partitions will show up in Step 4. However, it is recommended to recover the partitions one by one, if possible.

Same example as above, but the tree is looking like this:

(1) 2nd hard drive 40000MB (HD129:)

The partition table is obviously damaged. Therefore you must choose entry (1) and all 4 partitions will show up in Step 4.

You can manually apply a sector range in the next step (Step 3) in order to make the selected range fit more.

Physical Drives

If you selected one or more physical drives in Step1, the hard drives will be listed with all their partitions underneath. The physical drive are named by their BIOS number: FD0 is the 1st floppy drive, FD1 is the 2nd floppy drive, HD128: is the 1st hard drive, HD129: is the 2nd hard drive etc.

The NTFS system might use chained partition tables, if the drive contains more than one NT partition. That' s the reason why often partitions are displayed twice, as a NTFS partition and as a "DOS extended partition" (in these cases you should go with the "NTFS partition").

Usually you should pick the NTFS partition as the source to perform the data recovery on. Only if the right partition (with the approx. right size and position) is not shown, use the DOS extended partition or the whole drive.

Note: Choosing a certain partition is nothing more than choosing a certain start and end sector to be scanned on the particular drive. The start and end sector will be displayed for review in Step 3. It is possible to override these values there.

Logical Drives

If logical drives were selected Step 1, all available logical drives will be shown with their assigned drive letters (A:, B:, C:, ...).

Image files and remote drives

You can also load an image file or a remote drive by pressing the corresponding buttons at the bottom of the window.

If the image file is an image of a physical drive all partitions will be shown too and you can treat it like a physical drive.

Remote drives are physical drives on another computer, accessed through a serial cable or TCP/IP. They are treated like physical drives.

Now select the drive or partition you want to recover and press Next.

See also: Drives


Drives

Besides physical and logical drives, floppy drives, Jaz and Zip drives, GetDataBack accepts image files and arrangement files as a data sources to perform a recovery on. GetDataBack accepts five different kinds of data sources to select from:

  • Physical drives
  • Logical drives
  • Image files
  • Remote drives
  • Arrangement files

See also: Step 1, Step 2


Physical drives

Physical drives are tangible media like hard drives and diskettes. They have specific names:

FD0 | 1st diskette drive
FD1 | 2nd diskette drive
HD128 | 1st hard drive
HD129 | 2nd hard drive

These drives can have partitions you may select. If you do so only the part of the drive ("window") that constitutes that partition is visible for GetDataBack. If possible, you should select such a partition as the entity GetDataBack's scan is performed on. If you do not see any partition entries you should select the entry with the [image] Symbol.

See also: Drives, Step 2


Logical drives

* Logical drives are volumes known to the operation system as A:, B:, C: etc..

You may choose this in order to explore such a volume. An alternative access to these drives is selecting a partition in a physical drive.

See also: Drives


Image Files

*
Image files are files containing raw images of a drive. You can recover from an image file as you can from a physical or logical drive. Click the Image file button in Step 2 to open an image file as a drive.

Even partitions you can see within physical drives are displayed when contained in the image file.

Clone an entire drive

You can create image files using the Tools->Create image file command. You may use the image file instead of the original drive. You also can use image files created with other software, such as Runtime's DiskExplorer.

Multiple Files

Image files can consist of:

  • one file (e.g. 'drive128.img')

  • multiple files (e.g. 'drive128.img', 'drive128.001', 'drive128.002', ...)

This is helpful when imaging a drive larger than the maximum file size (2GB or 4GB, depending on the operating system). Fragments of a multiple file image are about 656MB in size. A smaller size indicated the end of the file set.

Compression

You can use compressed image files (e.g. 'drive128.imc') by selecting 'Compressed image data files (*.imc)' as file type in the file open dialog. This feature enables you to create drive images much smaller than the original.

Compressed files can be multiple file images too.

See also: Drives, File Open and File Create


File open and file create

This dialog requires a file name to open or create.

You can choose between the following File types:

  • Image files (IMG) are raw copies of drives.
  • Compressed image files (IMC) are compressed raw copies of drives.
  • Arrangement files (AGT) (read/only) are scripts describing an arrangement of several other kinds of drives.

Image files and compressed image files come in two flavors:

  • Multiple file unchecked stores the data in one single file.
  • Multiple file checked stores the data in multiple files with 656MB each. This makes the image more handsome and helps to overcome restrictions on file sizes.

See also: Drives


Arrangement files

Arrangement File

*

Arrangement files are basically short text files describing the data to be loaded. You can "glue" together different data sources.

Example 1:

;Arrangement file
;
,c:\diskimg1.img:
,c:\diskimg2.img:

This example will open c:\diskimg1.img and c:\diskimg2.img as one data source. If c:\diskimg1.img was 100 sectors in size and c:\diskimg2.img was 200 sectors in size the opened data source is 300 sectors in size.

Example 2:

;Arrangement file
;
,c:\diskimg1.img:0-50
,c:\diskimg2.img:10-

This example will open c:\diskimg1.img’s first 51 sectors and c:\diskimg2.img’s sectors 10-end (190 if sizes are as in example 1) as one data source.

Example 3:

;Arrangement file
;
0-999,c:\diskimg1.img:
,c:\diskimg2.img:

This example will open c:\diskimg1.img’s 100 sectors, insert 900 Null-sectors and open c:\diskimg2.img’s 200 sectors as one data source.

Example 4:

;Arrangement file
;
0-10,A:
,HD128:
,HD129:100-100
,NULL:0-99
,FD0:50-

This example will use A:’s sectors in 0-11, all sectors of HD128:, sector 100 of HD129, 100 Null-sectors and sectors 50 and up from FD0:

See also: Drives


Remote Drive Access

Remote Drives

This feature enables you to run the GetDataBack on one computer ("remote") while accessing the drives of another computer ("host").

The "remote" computer runs GetDataBack, the "host" computer runs HDHost. HDHost is a program available for download at http://www.runtime.org.

On the host side call the program HDHOST.EXE and configure the desired connection. When done click Wait for connection.

On the GetDataBack side click the Remote Drive button in Step 2. A new window will pop up requesting you to select and configure the kind of connection. When done click Connect and another window will pop up displaying the available physical drives on the host computer. Select one and you are back in the drive selection screen. Click Ok and the remote drive is loaded.

You can establish a two different kinds of connections:

  • Serial communication through RS232 (Com port)
  • TCP/IP communication through a network interface card (NIC)

Serial communication is quite slow, therefore you will probably prefer TCP/IP. However, serial communication is easier to setup and every computer is equipped with a serial port.

Serial Communication

Serial communication requires a Null-Modem Cable connecting both computers through the COM port. On both sides select the port number this cable is connected to. Both sides must use the same Baud rate.

TCP/IP Communication

TCP/IP communication in a LAN requires a network interface card (NIC).

As the Connection choose the IP that is associated with your NIC. If this computer does not get an IP address assigned by a DHCP server you might need to assign a static IP address in the Windows network configuration. A typical address is 192.168.1.51 for this machine and 192.168.1.50 for the host.

As the IP of host choose the IP of the host's connection. You might need to specify a static IP address (e.g. 192.168.1.50) in the Windows network configuration of the host computer.

Tips:

  • If you have problems connecting try to PING between host and remote. Go to the command prompt and type ping 192.168.1.50 on this computer. Try ping 192.168.1.51 on the host computer. (This assumes that 192.168.1.50 is the host's IP and 192.168.1.51 this computer's IP). The ping must be successful on both sides.
  • Disable all Firewalls.

See also: Drives


Step 3

Step 3: Select Range and File system

In Step 3 you are asked to select the range of the drive to be scanned and the type of file system you want to recover.

Normally the range and file system type is already set correctly by Step 2 and you don' t have to change anything.

Narrowing the sector range to be scanned to the area the file system was located will speed up the recovery and will enhance the recovery results.

However, do not alter the sector range to be searched unless

  • the partition you need to recover wasn't shown correctly in Step 2 and you therefore had to check the whole drive,
  • or if the preset sector range doesn't seem right and you know where the partition approximately was located.

To do so, select "Search partial drive" and insert the starting and the ending sector of the drive or partition. In case you don' t know the exact range rather enter a wider than a smaller range: The selected range must completely contain the partition you want to recover.

Using the "Excessive search" feature will slow down the recovery process, so check it only if the demanded file system is not displayed in Step 4 - especially on media with very few data or directory information on it - like diskettes. Checking this feature will yield more entries in Step 4.

To open a scan from a previous recovery click "Load Recovery".

Press Next to start the scanning of the drive.

GetDataBack will now scan the drive and the recovery process will be in full swing.

Depending on the size of the drive this process can take from a few minutes to several hours. Don' t interrupt this process unless you have to - you would have to do the scan all over again.

See also: Scanning the drive


Scanning the Drive

The "Scanning drive" window will give you information about the recovery process.

You can see:

  • the current process
  • the source of the recovery with the sector range to be scanned
  • the number of already identified directories and files
  • the number of boot records found
  • the sector which is currently examined
  • the remaining time the scan will take and a progress bar indicating the percentage of the drive already scanned.

Press Escape or click Stop if you want to abort this process.


Step 4

Step 4: Select File System

After the scan is complete, the file systems GetDataBack has found are displayed on the left side of the window.

Don't be confused, if you see a whole bunch of file systems! GetDataBack conducts a very thorough scan of your drive, and particularly when you have scanned a large drive with more than one partition, or a drive which was re-partitioned, the software can find many possible file system starts.

By default the most accurate file system is displayed on top of the list.

  • File systems with a quality of 50% or higher are marked with a green dot,
  • file systems with a quality of at least 10% with a yellow dot
  • and file systems with a quality of less than 10% with a red dot.
  • A green dot usually indicates a good file system with potentially high quality recovery results,
  • the file systems with a yellow dot can also produce very satisfactory results (especially if no green dot file systems show up),
  • the file systems with a red dot are not very promising.

But take a closer look! Which of the file systems in the list comes closest - in terms of the size of the partition, the cluster size and the file system type - to the file system you want to recover? Pick this one.

The file system details on the right side of the screen can give you additional information about the quality of the file system.

Now select the file system you want to get displayed in the recovery tree and press Next.

GetDataBack now will create the tree of the recovered directories and files. Depending on the size of your drive, this can take its time, but will be much faster than the scan. Do not stop this process unless you have to.

Pressing Back in Step 4 will take you back to Step 3. You would have to do the scan all over again when you resume the recovery from Step 3 unless you save the scan while in Step 4.


File System Details

The right windows in Step 4 give you additional information about the structure and quality of the detected file systems.

The file system details are structured as follows:

  • Name: The file system type.
  • Cluster0: The position of cluster 0 in the file system.
  • Cluster size: The number of sectors in one cluster. Possible values are 1-128 sectors, common values are 1-8.
  • Total sectors: The total number of sectors in the file system.
  • 1st Mft cluster: The cluster number of the start of the Master File Table.
  • 1st MFtmirr cluster: The cluster number of the start of the mirrored MFT.
  • Index buffer size: The size of an index buffer. An index buffer is an area where directory information is stored.
  • 1st root cluster: If any, the start cluster of the root directory (only available for FAT32 file systems).
  • Total clusters: The total number of clusters in the file system.
  • Min clusters used: The min. cluster range where data was found by the scan.
  • Max cluster used: The max. cluster range where data was found by the scan.
  • Debug info: B stands for boot record found, B0 for example means, that at least one boot record was found. M stands for MFTs found, the following number states the number of MFT structures found.

Should one of these values seem to be absolutely unreasonable, this could indicate that the quality of this file system is not very good and you might want to have a look at other file systems in the list (if there are any other).

The little bar-code-like graphic in the right bottom half can tell you even more about the quality of each file system:

Displayed are:

  • Mft starts: The cluster areas where Master file table entry starts were found.
  • File starts: The cluster areas where file starts were found.

The more the marks in these rows are in correspondence, the better the file system is. The percentage of corresponding file starts to Mft starts is indicated beneath those rows. Don' t be disappointed, if this doesn't come near to 100%. It never does, due to the fact that GetDataBack conducts a very thorough scan of the drive and always finds some kind of orphan data which could be associated with a file or Mft start.

The percentage is defined as:

100 * Matching_File_Starts / Mft_Starts

where

Matching_File_Starts is the number of sectors identified as a file start AND a sector a Mft entry points to,
Mft_Starts is the number of sectors a Mft entry points to.

There are always file starts that cannot be identified, therefore this value will usually not reach 100%. Even a low value like 30% can generate a perfect data recovery.

See also: Step 4


Step 5

Step 5: Recovery Tree

On the left side of the screen you see the recovery tree, consisting of the recovered directories and folders and a "lost files" folder created by the program, containing the files without directory information.

When you open a folder on the left side, the files in this folder are displayed on the right side - much as you know it from the Windows Explorer.

Copy

Now tag the files you want to copy. Push the copy button and a window will pop up where you can choose the destination to copy the files to. This destination can either be another hard drive, a local network drive, a Zip or Jaz drive, or a floppy drive. Never copy the files to the drive or partition you recovered the data from.

While you can see all your recovered files, use the viewer, the search function and the file information feature in the unregistered version. Copying files to a save medium requires that you register the software. Registering is very quick and very easy. You don' t have to conduct the recovery process all over again, just enter the registration key while you are in step 5 and the copying will be enabled.

Quality of the Recovery

Don' t feel insecure about the recovery results after copying the files. In most cases what you see in the recovery tree is what you get after copying the files. That means, if you can see your files in the recovery tree and they look alright, they most likely will be alright after saving them.

However, it is recommended to check several files. Use the following features of GetDataBack to verify the quality of the recovery:

  • View the file (F3)
  • Open the file with its native application
  • Investigate the file information for the file

It can happen, that you have folders in the recovery tree which look similar to this one: (1229BD). This means that the root directory entry for this directory was lost and the directory name could not be retrieved. The subdirectories (if there are any) and the files in the directory should nevertheless be in order.

Particularly in the "lost files" folder you will find files which look like this: #345HD33.doc This is due to the fact that these files were recovered without any directory information. Therefore the original file name could not be restored. The file extension though should be correct and can give you at least some information about the file.

If you have problems opening the recovered files please see our check list .

Save a recovery

To save your recovery for further use click File->Save Recovery and choose a file name. Never save this file to the drive or partition you recovered the data from.

This feature does not save the recovered files. It saves the structure of the recovery tree only. To save the recovered files see Copy .

Sort

Sort the files on the right side by size, name, attributes, creation data and so on by clicking on the corresponding column header.

Open

Open files by double-clicking the file, clicking the open button or pressing Enter. When possible the file will be opened in its native application. Otherwise you can choose the application to open the file with.

Clicking the Open with button or pressing Ctrl-Enter will allow you to choose the application to open the file with.

View

Use the viewer to have a first look at the files you recovered. Select the file you want to examine and press the view button or F3. The viewer is able to display the file content for various file types (.txt, .doc, .bmp). Where the file type is not supported the file content will be shown in hexadecimal format.

Rename

If the right file names didn't come up (for instance because the root directory information was destroyed), the rename property lets you rename these files before copying them. Select the file or folder you wish to rename and press F2. Of course you can also rename the files after you have copied them to a safe location.

Search

GetDataBack includes a file search function. Hit the search button and give in the search term.

Appearance of the file names - Attributes

Appearance | Meaning
filename.ext | normal file or directory
filename.ext | read/only
filename.ext | system
filename.ext | hidden
filename.ext | compressed
filename.ext | deleted

Deleted files

Recovered deleted files can be found in the directory where they were originally located. They are marked by a crossed-out file name. If you are looking for files from an emptied recycle bin you should look below the RECYCLE folder. Note that files inside the recycle bin do not longer have their original file names. However, they still have their original extension.

File information

Should you wish to dive deeper into your recovery you can have a look at the file information. Select the file you are interested in and click the file info button or F2.

Runtime's DiskExplorer

Select a file or folder and call Runtime's DiskExplorer. This program will give you low-level access to the directory entry of the selected file or folder.

Pressing Back in Step 5 will take you back to Step 4. You would have to do the creation of the recovery tree all over again when you resume the recovery from Step 4 unless you save the recovery while in Step 5.


File

File information

View detailed information about a file or folder displayed in the recovery tree by selecting the file or folder and clicking Recovery->Show info or the info button.

Information provided are:

  • Unicode name: The display name of the file or folder.
  • DOS name: The short name of the file or folder.
  • Type: The type (directory or file).
  • DOS Attributes: The attributes (a = archive flag, r = read only, h = hidden, s = system, l = volume name, d = directory, c = compressed).
  • Size: For files= the size of the file in bytes, for directories= the number of directories and files in this directory, the size of the directory.
  • Last modified: The date/time the file was last modified.
  • Created: The date/time the file or folder was created.
  • Last accessed: The date the file was last accessed.
  • Allocation by: Internal debug info.
  • Mft entry no.: The position of the entry in the Master File Table.
  • Parent Mft entry no.: The position of the file's directory in the Mft.
  • Mft location: The sector number where the Mft entry which describes this file was found.
  • First cluster: The first cluster of the file or folder.
  • First sector: The first sector of the file or folder.

See also: Runtime's DiskExplorer for NTFS


View File

The View File feature is able to display many text files (.txt, .doc, .rtf, .wri), many graphic files (.htm, .jpg, .bmp, .ico, .wmf). Binary and unknown formats will be displayed in a hex viewer.

Highlight the file you want to view in the recovery tree and click Recovery->View in the Main Menu.

See also: Step 5


Save and Load Recovery

Note: Never save any files to the drive you are about to recover!

Save and Load a Scan

After the scan of the drive is complete you can save this scan in Step 4 for future use. Just click File->Save Recovery and choose a destination. The resulting file will have the extension .ST4.
To load a scan follow Steps 1 and 2 like you did in the previous run, but click the "Load Recovery" button in Step 3. That way you don't have to do the scan all over again. This might be useful in case you are not satisfied with the recovery results and want for example choose another file system from the list in Step 4.

Select the first option if you want to load a drive scan and rebuilt the file system list. Hit Ok and select the Step 3 results file ~GDBSAVE.ST3. This file is created by the program in the default temp directory and contains the most recent scan. You cannot save the Step 3 results directly from GetDataBack, but you can always rename this file to save it for further use.

Select the second option if you want to load a file system list and go directly to Step 4. Hit Ok and select the right .ST4 file.

Save and Load a Recovery

After the recovery tree is complete you can save your recovery for further use in Step 5. Just click File->Save Recovery and choose a destination. The resulting file will have the extension .ST5.

To load a recovery follow Steps 1 and 2 like you did in the previous run, but click the "Load Recovery" button in Step 3, choose the third option, hit Ok and select the .ST5 file.


Options

In Options you can define

  • the default save directory, that is the directory where the recovered files will be copied to,
  • the default temp directory, that is the directory where files necessary for the recovery, the scan file and the log file will be saved,
  • the location of Runtime's DiskExplorer, if you have downloaded it and want to call it during the recovery process.

Never specify a directory that is located on the drive you are going to recover!

Checking "Allow duplicate file names" will cause the program to accept more than one file with the same file name in one directory. These file names might be different versions of the same file. If this option is not checked, GetDataBack will use the most recent entry. To be effective, this option must be set in or before Step4.

Check "Recover deleted files" if you want to include deleted files and directories in the recovery. Note: If you check this option, but uncheck the "Allow duplicate file names" option, GetDataBack will choose the most recent entry - regardless if it is deleted or not - if it encounters duplicates. To be effective, this option must be set in or before Step4.

Check "Recover lost files" if you expect to have files without any directory information at all on your disk. By default don't check this box, because especially when recovering a large or repartitioned drive you might get a lot of rubbish you probably won't need. To be effective, this option must be set in or before Step3.


Search

GetDataBack provides a comfortable file search function. To search for files or folders click Tools->Search files.

The File mask field expects a file name mask, such as *.* or *.doc.

Three different kinds of filters are available:

  • Date: Specify a start and end date and only files or folders with a modification date within this range will show up.
  • Size: Specify a size range and only fitting files will show up.
  • Type: Specify if you want to search for deleted files, not deleted files or both. Note: you must have included deleted files in the Options before the recovery tree was build.

Clicking Start will search the whole recovery tree according to your settings.

You can Stop the search at any time.

On completion of the search you can inspect the found files and folders in the lower window. You can do pretty much the same things you can do in the recovery tree: view, open, info, sort, copy, etc.

The Sync button brings you to the position of the file in the recovery tree.

The New button clears the current results.


Runtime

Runtime's DiskExplorer

Runtime's DiskExplorer for NTFS is a powerful disk editor, which enables you to

  • navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, MFT or MFT entries, by jumping to a certain sector etc.,
  • switch between several views, such as hex, text, directory, file entry, file entry detail, partition table and boot record view,
  • search your drive for text, boot records, partition tables and subdirectories,
  • investigate the volume' s boot record by looking at the volume information,
  • edit your drive by using the direct read/write mode (not recommended) or the virtual write mode,
  • view and recover even deleted files,
  • create a virtual volume when you boot record is lost or corrupted,
  • conduct your own data recovery by taking advantage of all these features.

In order to call Runtime's DiskExplorer for NTFS directly from GetDataBack download the program from our website http://www.runtime.org. Install it - however never install it to the drive you want to recover -, then click Tools->Options and specify the location of the DiskExplorer.

Calling DiskExplorer in Steps 1 and 2 will bring you to the start sector of your master drive, in Step 3 to the start of the selected drive or partition, in Steps 4 to the start of the Mft and in Step 5 to Mft entry of the selected file or folder.

Registering GetDataBack will not cover a registration key for Runtime's DiskExplorer, this product must be purchased separately.

For more information on Runtime's DiskExplorer please refer to the program's help or to our website.


Lost Files

GetDataBack is able to recover files even when all their MFT information is lost. This is possible on condition that the program can recognize those files by their file signature and file extension.

GetDataBack already can recognize a couple of file types, such as DOC-files, BMP-files, RIFF-files, ZIP-files, Help-files.

If you need to recover a lost file with a different file format, define the file format in the GDBNT.INI file. The location of the GDBNT.INI is stated in Help->Version Info.

Go to the LostFiles section of the GDBNT.INI and enter the file parameters in the following order (separated by comma):

  • Name of the file (free choice)
  • File extension
  • File signature length (between 2 and 8 bytes length)
  • File signature (in hex, located at the beginning of the file)
  • Type (reserved for further enhancement, enter 1)
  • Size of the file (if this information is not available in the file header, specify a length large enough to cover the size of the files you want to recover)

Example: Help files

Help files start with the signature $3F,$5F,$03,$00.
Found lost Help files will get the extension HLP in the recovery tree
The size will be determined by the double word found at position 12 in the first sector [12,4]

Help-File= HLP,4, $3F,$5F,$03,$00, 1, [12,4]

For further help refer to the GDB.INI.

The definition of files requires some experience, some research and a good disk editor such as Runtime's DiskExplorer.


Troubleshooting

These are the most common warnings or errors you might run into:

Access denied

COMCTRL32 outdated

Could not lock drive

DRV16 not found

I/O Error

Bad sector handling

If you get a runtime error, please submit a screenshot to: support@runtime.org.

See also: F.A.Q., Support, Doing a Data Recovery, Check List


Access Denied

Error: Access Denied

This message is displayed if you are trying to

  • open a file that is already in exclusive use by another process or
  • open a file in read/write mode that is write-protected.

See also: Image files


Outdated COMCTRL32

Outdated COMCTRL32.DLL

Your Windows version is using an outdated version of 'COMCTL32.DLL'. This component is an extension of the Windows operating system and comes usually with the MS Internet Explorer.

You will most probably have problems with this program's visual controls (you won't see the buttons). But you should still be able run this software.

It is recommended to download a new version at http://www.microsoft.com/msdownload/ieplatform/ie/comctrlx86.asp or to install a recent version of MS Internet Explorer.


Drive Locking Failed

Warning: Could Not Lock Drive

Locking a drive is a low-level feature for preventing several processes from accessing a physical or logical drive at the same time. You should verify no other processes are accessing the drive. If you Ignore the warning your process will possibly continue, but may cause damage to the data on the drive. Therefore, ignoring is not recommended.

See also: Drives


DRV16.DLL not found

Warning: DRV16.DLL not Found

This message is displayed on startup if the program runs on a Windows95/98/ME system and does not find the file DRV16.DLL.

This component provides physical drive access and is required by this program. You should quit the program and re-install this software.

See also: Physical drives


Read Error

Error: I/O Error

This message is displayed if the program encounters an error reading from a drive. This error is not recoverable, but you can ignore it.

You have the following choices:

Click Yes: the error is ignored and the operation continues.

Click Yes to all: the error is ignored and the operation continues. Future errors will be suppressed and ignored as well; you won't be prompted this message again. This condition is cancelled at the next regular prompt for a user input.


Bad sector

Bad Sectors Handling

An error was encountered during a sector block read operation.

Sectors are read in chunks of 16 sectors. If this operation fails this might be because of a single bad sector or of several bad sectors. You have the choice:

Skip sector block

All 16 sectors are considered bad. No attempt is made to retrieve possibly good sectors.

Retry accessing single sectors

The program retries reading the sectors one by one. This gives the chance to retrieve possibly good sectors in the neighborhood of a bad one. However, this can be very time consuming, especially if there are not good sectors at all.


F.A.Q.

GetDataBack for Windows 95/98/ME/NT/2000/XP for NTFS & Fat

Q. Can fragmentation of the disc affect the result of the recovery?

Q. Can I investigate the quality of my recovered files before I buy the software?

Q. Can I use GetDataBack to recover data from CD's, CDR's and DVD's?

Q. Can I use GetDataBack to recover data if my hard drive is not recognized by the BIOS of my computer?

Q. During usage of GetDataBack I do receive a disk error, what does this mean?

Q. How can I optimize the quality of the recovery?

Q. I do not find certain files in the recovery, how do I get these?

Q. I cannot open the recovered files. Why?

Q. I don't know which file system I had on my drive before it crashed. What shall I do?

Q. Is it safe to run GetDataBack on my crashed hard drive?

Q. The software only runs in a Windows environment, as my computer is a laptop, I cannot have more than one hard disk.

Q. Will GetDataBack work on a hard drive larger than 8.2 gigabyte?

Q. How do I recover files I deleted with Windows Explorer?

Q. Can fragmentation of the disc affect the result of the recovery?

A. Fragmentation in NTFS should not effect the results of the recovery. Information about a file's allocation is stored in a Mft entry (other than with a FAT file system, where this information is stored in the FAT). If the file shows up in the recovery tree, it should be recoverable. If it does not contain the expected data, you should review your selection in Step 4.

Top

Q. Can I investigate the quality of my recovered files before I buy the software?

A. Yes, GetDataBack contains a build-in viewer which lets you investigate the quality of your files and you can also open the files with their original application before you have to register the program.

Top

Q. Can I use GetDataBack to recover data from CD's, CDR's and DVD's?

A. No, GetDataBack is a software for hard drives, floppy drives, Jaz drives and Zip drives only.

Top

Q. Can I use GetDataBack to recover data if my hard drive is not recognized by the BIOS of my computer?

A. No, if the BIOS is not recognizing the hard drive, our software is not able to perform a recovery. Please make sure that the connections, jumper settings and controllers are ok. If the hard drive is still not recognized, try to connect it to another computer and see if it gets recognized there.

Top

Q. During usage of GetDataBack I do receive a disk error, what does this mean?

A. GetDataBack is a solution for software related problems, it cannot help you with failed hardware. A disk error is a sign for a hardware problem. We recommend to stop working with the corrupted drive until you make a disk image. (Every try to access data can increase corruption !) After successfully creating an image you can use the image file as an input for GetDataBack.

Top

Q. How can I optimize the quality of the recovery?

A. What did you choose in the second step? We recommend choosing physical drive for your recovery.
In Step 4 be sure to choose the file system which contains the most applicable information to perform the recovery on. You can compare the file system quality by viewing the details in the right window. Another indicator for better file system quality is the percentage rating on the right side of the graphic below. Before you register, please test enough files to be sure you are satisfied with the results of the recovery.
Try checking "Allow duplicate file names" in the options. This might bring up different versions of certain files.

See also our comprehensive Check List.

Top

Q. I do not find certain files in the recovery, how do I get these?

A. First please check the recommendations in How can I optimize the quality of the recovery.

Try the "Allow duplicate file names" option. This might bring up different versions of some files.

Try the "Recover lost files" feature.

See also our comprehensive Check List.

Top

Q. I cannot open the recovered files. Why?

A. There are two possible reasons for the inability to open the recovered files.

  1. Your files were overwritten by other data. In this case there is no way to retrieve the data.

  2. The second possible reason is that you have chosen the wrong file system entry in Step 4 of the recovery. Be sure to choose the file system that contains the most applicable information to perform the recovery on. You can compare the file system quality by viewing the details in the right window. Another indicator for better file system quality is the percentage rating on the right side of the graphic below.

Recommendations:

Check point 2. Re-run GetDataBack and proceed to Step 4. Try other entries, that come close in size and position to the partition you want to recover. We will gladly assist you in determining which entry to choose (see: Support).

See also our comprehensive Check List.

Top

Q. I don't know which file system I had on my drive before it crashed. What shall I do?

A. If you don't know which file system you had on your drive before the crash, you can use both of our demo versions of GetDataBack to explore your drive. First of all, you have to download the demos to a working Windows computer and install the software, than connect the crashed drive as the second hard drive and make sure that the BIOS is recognizing the drive. Now you can use the Fat and the NTFS demos to explore your drive. You cannot destroy anything, as long as the drive is not physically damaged, because GetDataBack is a read-only software.
After you followed the instructions, with the right version you will receive a recovery tree with your files and folders. You can evaluate the quality of the recovery by clicking 'recovery->open' in the main menu. If your files look ok, you can copy them to a safe location on another drive. (full version only)
A little hint if you are inexperienced with different Windows versions:
Win 3.11, Win 95, Win 98, Win Me use a FAT based file system.
Win NT, Win 2000 can have both file systems: NTFS or FAT.

Top

Q. Is it safe to run GetDataBack on my crashed hard drive?

A. Yes, as long as your drive doesn't have a physical problem, it is safe to use GetDataBack, because the program will not change anything on the crashed drive, it is a read- only software. Install the software on a working Windows computer and attach the hard drive which contains the lost files as a second hard drive to this computer. Make sure that the second hard drive is recognized by the BIOS. Then run GetDataBack and in Step 1 select your bad drive (usually this is HD129). Press ' next '. In Step 2 select the partition which contains the lost files. If the drive doesn't have more than one partition, select the whole drive. In Step 3 you will be asked to select the range of the drive to be scanned. Usually you don't have to change anything. Just go with the predefined selection and press ' next '. The program now will scan your drive. Depending on the the size of the drive this will take some time. As soon as the scan is ready you will see a list of of possible file systems the program has found. Usually you should select the first file system on the list. Press ' next '. Now the program will create the tree of the recovered files. After a while you will see a tree with you recovered files and folders. Now you can see whether GetDataBack has found the files. If the files are found you can evaluate the quality of the recovered files. Just select a file you are interested in and click ' Recovery->View' or ' Recovery->Open' in the main menu. If the files looks okay, they most likely will be ok after you have copied the recovered files to a safe location on another drive.

Top

Q. The software only runs in a Windows environment, as my computer is a laptop, I cannot have more than one hard disk

A. It would be possible to copy our software to a floppy, but this wouldn't help you because you would need to have a bootable windows system on the same floppy and that is impossible. In some case the remote feature might help.

Top

Q. Will GetDataBack work on a hard drive larger than 8.2 gigabyte?

A. Yes, GetDataBack will work on any size of hard drive, but huge hard drives can take a while to be scanned and recovered.

Top

Q. How do I recover files I deleted with Windows Explorer?

A. First, check "Recover deleted files" in the Options screen. Then run GetDataBack as usual until it has build the Recovery tree. "Permanently deleted" files can be found in their original folder (if still available). Files from "emptied recycle bins" can be found below the RECYCLE directory. Note that these files have lost their original file names, but still have their original extensions.
It is also a good idea to use the Search feature.

Top

See also: Support, Doing a Data Recovery, Check List


Support

You can contact us for support:

USA

Phone | 1-775-884-3922
Fax | 1-818-475-1741
Email | support@runtime.org
Website | http://www.runtime.org

Europe (Germany)

Phone | +49-30-280 8008
Fax | +49-30-690 88 444
Email | support_europe@runtime.org
Website | http://www.runtime.org

If you have any questions related to the use of this software, please call us or send us an email.

See also: F.A.Q., Doing a Data Recovery, Check List


Check List

Use this comprehensive check list only if you cannot open your recovered files before or after copying (corrupted files). It is intended to verify and discuss the various choices you made during the recovery process.

We assume that are already familiar with the article Doing a Data Recovery and followed its guidelines. We also assume you have read the descriptions and explanations in the articles for Step1, Step2, Step3, Step4 and Step5.

If the recovery results are unsatisfactory check:

  1. Always use a "Physical drive" in Step2. Use "Logical drives" only if you have, e.g. your drive does not show up as a "physical drive".

  2. Check that the capacity of the "2nd physical drive" (or whatever drive you want to recover) shown in Step2 matches the real capacity of this drive. If it does not match there might be an issue with your BIOS settings.

  3. Top level entry vs. partition sub entry:

    1. If the drive had one partition using the whole drive, select the top level entry (e.g. "2nd physical drive") in Step2 and do not change any range settings in Step3.

    2. If the drive had multiple partitions choose a corresponding partition sub entry in Step2 IF AND ONLY IF the partition entries are shown AND they reflect the original partitioning you want to recover.

      If you had put a new partition structure over the drive this information is useless and you should go with the top level entry.

      Only in the latter case (e.g. you chose the whole drive of 40GB and you KNOW it is the first partition of 20GB that needs to be recovered) it makes sense to change the range settings in Step3 (in this example set the range to 0-44000000). But remember, you can always also go with the top level entry, it might take some more time.

      NOTE: THE SELECTED RANGE MUST BE A SUPER SET OF THE PARTITION YOU WANT TO RECOVER! (That's why we chose 44 instead of 40 Million in the example. This makes sure the 20GB partition that might have been 21GB is completely inside the range.)

  4. In Step4 you have to choose the entry that matches the partition you want to recover BEST. These entries are not necessarily real file systems, they merely describe POSSIBLE file systems. The entries at the top have a higher chance of being correct than entries in lower rows. BUT, THIS DETERMINATION WAS MADE FROM GETDATABACK AND IS NOT ALWAYS TRUE. If GDB would be able to determine the correct entry safely there would be no Step4 (at least in cases with one partition on the drive)!

    You MUST make the correct choice here, otherwise the recovery tree will show only crap. An entry is either right or wrong for a certain partition you want to recover.

    Usually you go with the first entry. We will demonstrate a selection procedure below for cases where the first one is wrong (6).

  5. In Step5 you have to check the files are ok. Use the internal viewer (F3) or open the files with their associated applications (double-click). The primary purpose of this check is to verify the selection in Step4. Use files that are easy to check, e.g. text files or EXE files or DLL files. EXE and DLL files are easily recognized by their beginning "MZ" signature. IMPORTANT FOR NTFS: the files you check MUST be larger than 2KB.

    Interpretation of the file check: If "many" checks are positive, the Step4 selection was correct. If no check was positive the Step4 selection was wrong and you have to go back to Step4 and choose another entry. If no Step4 entry passes the test you should go back to Step3 and select "Excessive Search". This will yield additional Step4 entries you can test.

  6. How to evaluate entries in Step4?

    A list entry has the format:

    <FILESYSTEM> at sector XXX, cluster size YYY (ZZZZ MB)

    Example:

    NTFS at sector 63, cluster size 8 (20000MB)

    Check this:

    1. Check the location (at sector 63 in the example above). If the first partition on a drive is an NTFS partition it almost always starts at sector 63. The number displayed is the exact partition start. If the location does not match the remembered location of the partition by a margin of less than 5% (rel. to the drive size) this is not the correct entry.

    2. The cluster size is usually not helpful because nobody knows the cluster size of a partition he once formatted (see 6d).

    3. Check the size (20000 MB above). This number should approximate the remembered size of the lost partition within a 10% margin. If it doesn't this is not the correct entry.

    Further information can be obtained by the "File system detail" on the right window in Step4:

    4. File System Details in GDB for NTFS

      • Name: The file system type, always NTFS.

      • Cluster0: The position of cluster 0 in the file system.

      • Cluster size: The number of sectors in one cluster. Possible values are 1-128 sectors, common values are 1-8.

      • Total sectors: The total number of sectors in the file system.

      • 1st Mft cluster: The cluster number of the start of the Master File Table.

      • 1st MFtmirr cluster: The cluster number of the start of the mirrored MFT.

      • Index buffer size: The size of an index buffer. An index buffer is an area where directory information is stored.

      • 1st root cluster: If any, the start cluster of the root directory (only available for FAT32 file systems).

      • Total clusters: The total number of clusters in the file system.

      • Min clusters used: The min. cluster range where data was found by the scan.

      • Max cluster used: The max. cluster range where data was found by the scan.

      • Debug info: B stands for boot record found, B0 for example means, that at least one boot record was found. M stands for MFTs found, the following number states the number of MFT structures found.

      Check this:

    1. Check the value of the cluster size: Common are 1-8 only.

    2. Check the "Debug Info". This info tells you HOW GetDataBack came to proposing this entry. There are three different methods:

      • B0 - by a boot record

      • M1 - by a MFT (Master File Table) found

      • Cnnnn - by matches of file start signatures against found file entries

      Entries with a C are only available if you used "Excessive Search".

      M1 and C entries might be combined to one entry if they describe the same file system (e.g. M1C8933). B0 entries are not combined. That's why you often see duplicates in the first two rows.

      B0 entries are usually the best. However they might be misleading especially when a drive was reformatted. They should always be confirmed by the existence of a M1 entry. If you have to choose between two equal entries, one is a B0 and one is a M1, choose the B0.

      A M1 entry is the most significant entry because this really reflect a found MFT table.

      A C entry - available only with "Excessive Search" checked - helps especially in cases with little directory information and no or useless boot record information. It also might help confirming or excluding B0 or M entries.

    5. The "Bar code" on the right bottom can give further information about a certain entry. The more the marks in these rows are in correspondence, the better the file system is (HOWEVER, finally there is only a YES or a NO for choosing this file system):

      Displayed are:

      • Mft starts: The cluster areas where Master file table entry starts were found.

      • File starts: The cluster areas where file starts were found.

      The percentage of corresponding file starts to Mft starts is indicated right of those rows. Don' t be disappointed, if this doesn't come near to 100%. It never does, due to the fact that GetDataBack conducts a very thorough scan of the drive and always finds some kind of orphan data which could be associated with a file or Mft start.

      The percentage is defined as:

      100 * Matching_File_Starts / Mft_Starts

      where

      Matching_File_Starts is the number of sectors identified as a file start AND a sector a Mft entry points to,

      Mft_Starts is the number of sectors a Mft entry points to.

      There are always file starts that cannot be identified, therefore this value will usually not reach 100%. Even a low value like 30% can generate a perfect data recovery.

  7. Other means to improve the quality of the recovery:

    • Check "Allow duplicate file names" in or before Step4. This might bring up different versions of files with the same file name, possibly a desired one that otherwise is suppressed.

    • Check "Recover deleted files" ONLY if you want to recover files deleted with Windows Explorer or by emptying the Recycle Bin. This option must be checked in or before Step4. When checking this option you also should check "Allow duplicate file names".

    • A Note on Fragmentation: NTFS RECOVERY DOES NOT HAVE A PROBLEM WITH FRAGMENTATION. If a file is corrupted it was either overwritten or you have chosen a wrong entry in Step4.

See also: F.A.Q., Support, Doing a Data Recovery


Show Data Structures

The following information about the data structures of the drive/partition in the recovery tree are provided:

  • Drive: The drive/device the data recovery was performed on.
  • Window info: The drive/partition displayed in the recovery tree.
  • Entire drive: States whether or not the whole drive was scanned.
  • From sector: Starting sector of the drive/partition displayed in the recovery tree.
  • To sector: Ending sector of the drive/partition displayed in the recovery tree.
  • File system: File system of the recovered drive.
  • FileSystemDesc: Detailed description of the file system.
  • Excessive search: States whether excessive search for file systems was selected in step 3.

All other information are for debug purposes and though not of much use for the user.