Leaving out the cases of file fragmentation, normally, a file is split into two functional parts – file metadata and file contents. The metadata is a service information created by the file system for the purposes of file indication inside the system itself. Generally, it contains critical file attributes, such as file name, location on the storage, date of file creation and modification.
Among the factors causing file disappearance there is loss of the file metadata, i.e. the subsidiary information vital for the file system to locate the exact file required by the user. Loss of file metadata may be brought about by several factors such as disk formatting, logical failure or mere file deletion.
As commonly known, no data is completely deleted unless overwritten. File contents, in other words raw files, continue remaining on the disk, however, unlinked from the information about their location, name, size etc. Luckily, these remains may contain signs of similar file types – so-called file signatures – that can be categorized into separate groups. File signatures are either special data fragments, which are stored to the file header for the purposes of file identification, or simply a repeated file fragment common for all files of this type.
In order to recognize files by type, Recovery Explorer exploits the technology of IntelliRAW. The software is bundled with a pre-defined list of IntelliRAW rules that already include the signatures to define most common file groups. The software also provides you with a possibility of creating and adding your own file descriptors for non-standard unique files.
IntelliRAW gives an extra chance to get the files back in the cases when a conventional scan has not satisfied you with the result. The assignment of data recovery by known content consists in finding lost user’s files without file metadata employing solely file signatures prescribed in the IntelliRAW rules.
All in all, search of lost data by file signatures can be a solution in case when the files metadata area, such as MFT in the NTFS file system, has sustained damage or overwriting. Yet, although effective in most cases, the search results may surprise with lack of file names, incorrect size or file incompleteness, the information that remained in the lost metadata.
How does it work?
- If a file is of a widespread type, the rule for its search may be already built into the program. Presently, the inbuilt rules include common archives, images, music, audio etc. file formats.
In order to search such files using IntelliRAW, enable the check box.
- If the program does not recognize the file type, please, do the following:
- Download and install the IntelliRAW editor
- Download and install CI Hex Viewer
- Using CI Hex Viewer analyze the file of the searched type for the presence of signatures or common data blocks
- Create the search rules, following the instructions in the IntelliRAW editor
- Save the rules into a file
- Enable I want to use my own rules and press Load rules
- After a successful load, the program will use the rules. Files found using user-defined rules can be found in $Custom folder: