recover a deleted file

Recover My Files is a data recovery program that uses file carving to extract lost files from unallocated clusters. Recovery is based on the interpretation of file content, usually through the process of reverse engineering a file type.
It can be used to recover data from external and internal hard disks, in FAT, NTFS, HFS and HFS+ file systems.
The program uses two techniques: a lost file, and a lost drive recovery.
In the lost file recovery technique the program finds deleted file entries, and if requested will do a file carve of selected file types. A variety of popular file types can be found and carved. There is no way to add unknown file types. The file name is found in the deleted file search, but not in the lost file. This is because in most file systems the file name and date/times are stored on disk and are only marked for re-use by the system, and not completely removed.In the drive recovery technique the program finds orphaned file system entries and reconstructs the missing/lost/corrupted volumes. The user can help the program by selecting file types that may have existed on the old system, but for majority of cases the automatic detection works. The user can also do a file carve in this technique as well. The program will reconstruct the file names and date times if available. This is obtained from non-deleted file system records such as from the NTFS $MFT as discussed here.The program can be used on physical drives, forensic images, and RAID drives. In the latter case it can also reconstruct the RAID structure. Files can only be recovered after purchasing a product activation key.

You do not have permission to view the full content of this post. Log in or register now.