RAW data recovery

Leaving out the cases of file fragmentation, normally, a file is split into two functional parts – file metadata and file contents. Metadata is service information created by the file system for the purposes of file indication inside the system itself. Generally, it contains critical file attributes, such as file name, location on the storage, date of file creation and last modification.

Among the factors causing the loss of a file is loss of its metadata, i.e. the subsidiary information used by the file system for locating the exact file required by the user. The loss of file metadata may be brought about by several factors such as disk formatting, logical failure or mere file deletion.

As commonly known, no data is completely deleted unless it gets overwritten. File contents, in other words, raw files, remain on the disk, however, they become unlinked from the information about their location, name, size, etc. Luckily, these remains may contain signs of similar file types – the so-called file signatures – that can be categorized into separate groups. File signatures are either special data fragments, which are stored next to the file header for the purposes of file identification, or simply a repeated file fragment common for all files of this type.

To recognize files by their type, Recovery Explorer exploits the technology of IntelliRAW. The software is bundled with a pre-defined list of IntelliRAW rules that already include the signatures for defining most common file groups. The software also provides you with the possibility of creating and adding your own file descriptors for non-standard unique file types.

IntelliRAW gives an extra chance to get the files back in the cases when you are not satisfied with the result of a conventional scan. The purpose of data recovery by known content is to find the lost user’s files without file metadata employing solely file signatures described in the IntelliRAW rules.

All in all, the search of lost data by file signatures is usually applied in cases when the area containing the metadata of files, such as the MFT in the NTFS file system, was corrupted or overwritten. Yet, although this approach is effective in most cases, owing to the fact that the metadata is missing, the results may disappoint by lack of file names, incorrect size or file incompleteness.

How does IntelliRAW work?

If a file is of a widespread type, the rule for its search may be already built into the program. Presently, the inbuilt rules include common archives, images, music, audio, etc. file formats.
To search for such files using IntelliRAW, enable the check box.
If the program does not recognize the file type, please, do the following:

• Download and install the IntelliRAW editor

  

• Download and install CI Hex Viewer

• Using CI Hex Viewer analyze the file of the searched type for the presence of signatures or common data blocks

  

• Create the search rules following the instructions in the IntelliRAW editor

• Save the rules into a file

• Enable “I want to use my own rules” and press “Load rules”

• After a successful loading, the program will use the rules. Files found using the user-defined rules can be found in the $Custom folder.