Help System

 

Table of Contents

 

1        INTRODUCTION.. 1

2        GETTING STARTED! 2

2.1    Installation. 2

2.2    Wizard. 3

2.3    Browse Method: 7

2.4    Search Method: 7

2.5    Surface Scan Method: 8

3        RECOVERING DELETED FILES. 9

3.1    Browse. 10

3.2    Viewing Deleted Files. 11

3.3    Recovering Deleted Files. 13

4        OPTIONS. 14

5        UNINSTALL. 15

6        REQUIREMENTS. 15

7        TROUBLESHOOTING.. 15

8        FAQ.. 15

8.1    Questions About File Recovery. 15

8.2    Questions About NTFS. 17

8.3    Questions About Drive Indexing. 18

8.4    Questions About Browsing. 19

8.5    Questions About Deleted Files Search. 20

8.6    Questions About Quick Viewer. 21

8.7    Questions About Disk Surface Scan. 21

9        ERROR REFERENCE. 24

10      GLOSSARY.. 25

11       CONTACT US. 26

 

1          INTRODUCTION

 

Thank you for choosing Pandora Recovery software.

 

This product will help you find and recover your deleted files from NTFS and FAT-formatted volumes. Pandora Recovery will allow you to scan all files and directories on any logical drive of your computer with supported file format. Once the scanning is complete you have full control over which files to recover and what destination to recover them to.

To get started you can use our Wizard feature, which will guide you through recovering your deleted file(s).

 

Important Note:

 

It is VERY IMPORTANT that you do not create, modify, or edit data on the drive that your lost data resides on. This includes, but is not limited to, installing new software (such as Pandora Recovery) to the drive, running software on the drive (including your operating system), or creating new files. This file activity may cause partial or even permanent loss of your deleted data.

 

If your lost data resides on your C: it is STRONGLY RECOMMENDED you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer. Please consult your computer manufacturer for assistance configuring hard drives in this manner.

 

2          GETTING STARTED!

 

2.1        Installation

 

Installing Pandora Recovery is accomplished by running the installation utility available at http://www.pandorarecovery.com and then accepting the End User License Agreement (EULA), and then completing a few quick settings as detailed below.

 

Click on the "Next" button to proceed to License Agreement page.

 

Click on the "I Agree" button, or "Cancel" if you don't agree. Note, clicking "Cancel" button will exit out of installation.

 

 

Once you have click on the "Next" button you will see a progress window. Once it has finished the below window will appear.

 

 

Click on the "Finish" button.

 

CONGRATULATIONS!   You can now recover deleted files.

 

2.2         Wizard

 

An easy way to get started in recovering your deleted file(s) is by using the Wizard. By default the Wizard will open automatically when you start Pandora Recovery. You can also access the Wizard by clicking on the wizard icon in the program toolbar.

 

Below is the first window that will appear in the wizard.

 

 

Next - This button will take you to next step to recovering your deleted file(s).

Start this Wizard the next time Pandora Recovery starts - This check box allows you to disable or enable Wizard from starting automatically when you open Pandora Recovery.

View Help - This button will take you to our help system.

Exit Wizard - This button will close out the wizard window.

 

Once you have clicked on the "Next" button the next window below will be displayed.

 

 

Open Recycle Bin - This button will take you to your computers recycling bin. You should click this button first to see if your deleted files are in your recycling bin.

Yes, I found my files - Please select this option if have found deleted files that you want to recover in your recycling bin.

No, I've not found my files - Please select this option if you have NOT found deleted files that you want to recover in your recycling bin.

Back - This button will take you to the previous wizard window.

Next - This button will take you to next step to recovering your deleted file(s).

Start this Wizard the next time Pandora Recovery starts - This check box allows you to disable or enable Wizard from starting automatically when you open Pandora Recovery.

View Help - This button will take you to our help system.

Exit Wizard - This button will close out the wizard window.

 

Yes, I found my files:

 

If you have selected "Yes, I found my files" and click on the "Next" button the following window screen will appear:

 

 

Close Pandora Recovery when I click the 'Finish' button - This will close the wizard window and Pandora Recovery when Finished button is clicked on.

Back - This button will take you to the previous wizard window.

Finish - This button will close out your wizard window.

Start this Wizard the next time Pandora Recovery starts - This check box allows you to disable or enable Wizard from starting automatically when you open Pandora Recovery.

View Help - This button will take you to our help system.

Exit Wizard - This button will close out the wizard window.

 

No, I've Not found my files:

 

If you have selected "No, I've not found my files" and click on the "Next" button, the following screen below will appear.

 

A list of the drives attached to your computer will be displayed. Those that are grayed out will not be available to you for recovery, most likely due to an unsupported file system

 

Select the hard drive in which your deleted file was located on and click on the "Next" button.

 

 

Back - This button will take you to the previous wizard window.

Next - This button will take you to next step to recovering your deleted file(s).

Start this Wizard the next time Pandora Recovery starts - This check box allows you to disable or enable Wizard from starting automatically when you open Pandora Recovery.

View Help - This button will take you to our help system.

Exit Wizard - This button will close out the wizard window.

 

Once you have clicked on the "Next" button, the below window screen will appear.

 

 

Browse- This selection will scan the hard drive selected in the previous window and then allow you to browse the available folders for deleted file(s).

Search - This selection will take you to Pandora Recovery Search page where you can search for specific files by name, date, and other parameters.

Deep (Surface) Scan - This selection will scan the hard drive selected in the previous window for certain supported file types.

Back - This button will take you to the previous wizard window.

Next - This button will take you to next step to recovering your deleted file(s).

Start this Wizard the next time Pandora Recovery starts - This check box allows you to disable or enable Wizard from starting automatically when you open Pandora Recovery.

View Help - This button will take you to our help system.

Exit Wizard - This button will close out the wizard window.

 

2.3        Browse Method:

 

If you have selected the "Browse" method, the "Next" button will index the hard drive previously selected and display deleted files found on that hard drive. Please see our Recovering Deleted Files section to learn how to recover deleted files(s).

 

2.4        Search Method:

 

If you have selected the "Search" method, the "Next" button will take you to the Pandora Recovery Search page. You can also get to the "Search" method by clicking on the "Search" tab at the very top. Enter the search parameters for the deleted file(s) you are looking for and then click the "Search" button. A list of files matching your search criteria will be displayed as shown in the example below.

 

 

Search Drive - This field gives you the option to select a hard drive. A list of the drives attached to your computer will be displayed. Those that are grayed out will not be available to you for recovery. This is due to file system limitations. Note that you can only select one logical drive.

File Name - This field gives you the following options:

 

 - Like: Search for files that are similar to what you have in the File Name field. Enter characters in between * asterisk.

 - Exactly: Search for files that are exactly to what you have in the File Name fields.

File Size Between - This field gives you the option to search for specific file sizes.

Created / Last Accessed - This field gives you the option to search based on created or last accessed dates.

Search - This button will display a list of files (if any) that that match your search criteria.

Stop - This button will stop the search process.

Reset - This will reset all fields back to its default values.

 

Please see our Recovering Deleted Files section to learn how to recover deleted files(s).

 

2.5       Surface Scan Method:

 

If you have selected the "Surface Scan" method, the "Next" button will take you to the Pandora Recovery Surface Scan page. You can also get to the Surface Scan page by selecting the "Surface Scan" tab at the top.

 

 

What do you want to search for - This section displays the different file types that Pandora Recovery supports and can scan for.

Scan this disc drive - This drop down field allows you select the disk drive you wish to scan.

Start Disk Surface Scan - Once you have selected a supported file type and disc drive, the button will star scanning your disk drive for file types selected.

 

Please see our Recovering Deleted Files section to learn how to recover deleted files(s).

 

3          RECOVERING DELETED FILES

 

Pandora Recovery allows you to recover all kinds of files from volumes formatted using FAT and NTFS, including compressed, sparse and encrypted files (see Glossary for more information about these terms). To recover deleted items you first need to scan disk drive for deleted files. You can scan by using any of the below scanning methods.

 

1. Browse Method

2. Search Method

3. Surface Scan Method

 

The steps to recovering deleted file(s) are simple:

 

    1. Browse (Index Drive ), Search or Surface scan (You can use the wizard feature to do this).
    2. Find and View deleted file(s) you wish to recover.
    3. Recover deleted file(s).

 

Important Note:

 

It is VERY IMPORTANT you do not create, modify, or edit data on the drive that your lost data resides on. This includes, but is not limited to, installing new software (such as Pandora Recovery) to the drive, running software on the drive (including your operating system), or creating new files. This file activity may cause partial or even permanent loss of your deleted data.

 

If you're lost data resides on your C: it is STRONGLY RECOMMENDED you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer. Please consult your computer manufacturer for assistance configuring hard drives in this manner.

 

3.1         Browse

 

The first thing you need to do in order to recover deleted file(s) is index the hard (Browse method) drive in which deleted file(s) are located or you can also use our Surface Scan method. You can do this by using our Wizard feature or you can do this by doing the following:

 

1.  Right click on the drive in which deleted file(s) are located on and select "Index". If you have already indexed that drive select "reindex". You can also do this by selecting the drive and then clicking the index icon in the tool bar menu, or go to "File" and select Index.

 

                  A small window will appear showing the indexing process.

 

 

A list of deleted files will be displayed. Below is an example.

 

 

3.2       Viewing Deleted Files

 

Once you have indexed a drive, Pandora Recovery will allow you to view deleted files before you decide you want to recover them by using "Quick Viewer". In order to find your deleted file(s) faster selecting the "Show Deleted Items Only" icon can help you by only displaying files that have been deleted.

 

 Quick View:

 

To use quick viewer you can select deleted file and or click the Quick Viewer icon   or right click on deleted file and select "Quick View". Quick View will then display a preview of deleted file. An example is shown below of an image file that was deleted. Note that not all files can be viewed in this manner, specifically large files.

 

 

Deleted Files Have Different Appearances:

 

Deleted files or folders have different appearance in Browse tab than existing ones. See the picture shown below.


 

* = Deleted files and folders have Red Cross over the icon.

 

Red = File is an overwritten deleted file, whose clusters are partially reused (overwritten) by other files. When a file has been deleted, the disk space occupied by the file can be reused by file system. The file system can reallocate this space for data of newly created files. So the deleted file becomes overwritten. There are more chances that an overwritten file is corrupted and can not be recovered successfully. You can recover overwritten files but there are no guarantees that they will be recovered successfully or in their entirety.

 

Blue = File is a compressed file.

 

Green = File is an encrypted file.

 

3.3       Recovering Deleted Files

 

Once you have indexed (Browse method) your hard drive or have used one of our scan methods - Browse, Search, or Surface Scan and have found a deleted file, Pandora Recovery can recover those deleted files by doing the following.

 

1.       Right click on deleted file and select "Recover" or select deleted file and click the recover icon. The window below will be displayed:

 

 

Browse - This button allows you to select the location of where you want to recover delete file(s). You should recover deleted file to a different hard drive then where it originally was located on.

Help - This button takes you to our help system.

Recover Now - This button will attempt to recover deleted file(s) and display a progress window.

 

2. Click Recover Now to begin the recovery process. The window below will be displayed.

 

 

Once the recovery process has been completed you can click on the "Close" button.

 

To view your recovered deleted file, go to the location where you recovered the file to.

 

4          OPTIONS

 

Pandora Recovery options are located under "Tools" of the tool bar menu.

 

General Tab:

 

 

Show Wizard at Start up - This check box gives you the option to disable or enable Wizard from automatically starting once you have opened Pandora Recover.

Save drive indexing cache to disk - This check box gives you the option to disable or enable from saving indexing to your cache.

Logging - This gives you the option to choice the type of logging and size limit you which to have on your log file.

 

Update Tab:

 

Allows you to configure how auto-update functions. If desired, you can completely disable auto-update and then manually check for updates by pressing the Check for updates button.

 

5          UNINSTALL

 

To Uninstall Pandora Recovery please do the following:

 

4.                         Click the Start button.

5.                         Click All Programs.

6.                         Click Pandora Recovery.

7.                         Click on Uninstall and then follow the step by step instructions.

8.                         Or use Add/Remove Programs as found in your Control Panel.

 

6          REQUIREMENTS

 

System Requirements:

 

Windows XP SP 1 or higher, Windows 2000, Windows 2003 Server or Windows Vista

 

7          TROUBLESHOOTING

 

Please visit the support section our website for further assistance. http://www.PandoraRecovery.com/support/

 

8          FAQ

 

Questions About File Recovery

Questions About NTFS

Questions About Drive Indexing

Questions About Browsing

Questions About Deleted Files Search

Questions About Quick Viewer

Questions About Disk Surface

 

8.1           Questions About File Recovery

 

I've deleted very important information. What should I do to keep it safe from corruption?

It is VERY IMPORTANT you do not create, modify, or edit data on the drive that your lost data resides on. This includes, but is not limited to, installing new software (such as Pandora Recovery) to the drive, running software on the drive (including your operating system), or creating new files. This file activity may cause partial or even permanent loss of your deleted data.

If your lost data resides on your C: it is STRONGLY RECOMMENDED you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer. Please consult your computer manufacturer for assistance configuring hard drives in this manner.

 

I reformatted the disk drive. Can I recover information using Pandora Recovery?

Yes, you can; however, please use our Surface Scan Method.

 

What file systems are supported by Pandora Recovery?

Currently Pandora Recovery supports the NTFS, FAT16 and FAT32 file systems. You can recover deleted files only from disc drives that are formatted using the above listed file systems.

 

Can I recover deleted files from the disk formatted using FAT32 file system?

Yes. This version of Pandora Recovery allows you recover deleted files from FAT/FAT32 formatted drives.

 

Should I recover file attributes and alternative data streams?

Yes, this useful information should be recovered. Alternative streams often contain file metadata, while file attributes contain information about how files are displayed in Windows Explorer.

 

Why can't I recover alternative data streams to a FAT32-formatted disc drive?

FAT32 doesn't support alternative streams. When you try to recover a file containing more than one stream, only its unnamed data stream will be recovered.

 

Why shouldn't I recover deleted files to the same disc drive they were originally located?

The data of newly created files may overwrite the data of deleted files. That may cause permanent loss of data.

 

Where should I recover my deleted files to?

You should recover files to a different disk drive. For example, if you need to recover deleted files from disc C:, recover them to D:\Recovered Files folder. If the destination folder doesn't exist, Pandora Recovery will create it automatically.

 

When I recover a group of deleted files or folders with similar names, it renames some of them. Why so?

Files within one folder must have unique names. This condition is not always true for deleted files; because of that reason Pandora Recovery renames the files to make their names unique within a folder.

 

I have many deleted files with the same names. How can I determine which one I need to recover?

You can recover all files and then open each one using the appropriate application. By opening each file you can determine which one you need by its content. You may also use Quick Viewer to determine which file you need to recover.

 

Can I recover an encrypted file using Pandora Recovery?

Yes, Pandora Recovery allows you recover files encrypted by EFS, the Encrypting File System.

 

How does Pandora Recovery recover encrypted files? Does it decipher them?

Pandora Recovery doesn't decipher contents of encrypted files. Instead of that it copies content of an encrypted file in raw mode as data back-up applications do.

 

Can I recover encrypted files belonging to other users?

You can not recover encrypted files that are owned by other users.

 

I have recovered an encrypted file, but it contains junk. Why did this happen?

This may happen because of following reasons:


1. The contents of the file were overwritten by other files.
2. The $EFS attribute of the file was corrupted.
3. If you recover files that are owned by another user, EFS can't decipher its content. That is why you may see junk.

 

8.2         Questions About NTFS

 

In what operating systems is NTFS used?

NTFS is the default file system in all modern operating systems from Microsoft, such as Windows 2000, Windows XP and Windows Vista.

.

What are $DATA and $FILE_NAME attributes?

Do not confuse NTFS file attributes with Archive, Hidden, System (and others) attributes. The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. $FILE_NAME attribute contains information about file's name, creation/modification date and so on. $DATA attribute may contain data of file's unnamed or alternative data stream. Learn more about NTFS attributes in NTFS File Types article on www.ntfs.com.

 

What is an alternative file stream?

In NTFS, all files have at least a file stream also called unnamed $DATA stream. Unnamed stream contains data of the file.  Alternative streams usually contain file-related metadata. For example, MP3 music file may contain unnamed stream, where data are stored, and one or several additional streams where composition genre, album name and author's name are stored.

 

What are Archive, Hidden, System (and others) file attributes?

Each file or folder on a disk has none, one or several assigned attributes, such as Archive, Hidden, System, Not Content Indexed and so on. For example a file having Hidden attribute isn't displayed in Windows Explorer view. Pandora Recovery can restore original attributes of a deleted file or folder. Do not confuse such file attributes with NTFS file attributes ($DATA, $FILE_NAME and so on).

 

What is $EFS attribute?

$EFS attribute contains information needed by EFS, the Encrypting File System, to decipher contents of an encrypted file. If $EFS attribute is missing or corrupted, the file can't be decrypted.

 

8.3         Questions About Drive Indexing

 

What happens when Pandora Recovery indexes my drive?

When indexing, Pandora Recovery collects information from your disk's file allocation table (MFT, the Master File Table). MFT contains information about both existing and deleted files. Pandora Recovery creates index of all deleted files in memory and can save indexing information to disk for later use.

 

Why can't it index my CD-ROM disc and my floppy disk?

Your CD-ROM disc is formatted in CDFS file system, and your floppy disk has FAT12 file system. Both CDFS and FAT12 are not supported by this version of Pandora Recovery.

 

What is the difference between physical disk and logical disk?

Physical disk is the hardware located inside of your computer. When you install operating system on your computer, you can create one or several logical discs on one physical disc. Logical discs usually have a letter assigned, for example, C:.

 

What happens if I uncheck 'Save drive indexing cache to disk' flag in General tab of Options dialog?

Pandora Recovery saves drives indexing information as hidden files to its installation directory. It is done to switch between discs more quickly and to not index disc each time you choose to open its content in Browse tab. If you uncheck this flag, Pandora Recovery won't save indexing information to disc. But it will require more time when you switch between discs in Browse tab.

 

8.4         Questions About Browsing

 

Why are some of the disc drives grayed out? Can I open their contents?

No, you can not open contents of grayed disc drives, because they are formatted using a an unsupported file system.

 

What happens when I click 'Show Deleted Items Only' toolbar button?

When you press this button, Pandora Recovery hides all folders that do not contain deleted files and shows only deleted files in current folder.  

 

What files are contained in 'Orphan Folders' seen in root folder of my disk?

Orphan Folders can contain deleted files only. They are virtual folders, which means, they do not physically exist.

 

Can orphan folders be recovered?

Yes, you can recover contents of an Orphan Folder.

 

Where do 'Orphan Folders' appear from?

During indexing, Pandora Recovery tries to reconstruct the original location of deleted files. In several cases it is impossible. In such cases deleted files are placed to virtual deleted folders called Orphan Folders. Orphan Folders are always placed into the root folder of the disc so that it can be quickly accessed.

 

Why some files are displayed in green and blue?

Compressed files are displayed in blue and encrypted files are displayed in green. Pandora Recovery allows you to recover all kinds of files from volumes formatted using NTFS, including compressed, sparse and encrypted files.

 

Why some files are displayed in red color?

Overwritten deleted files are displayed in red color. When a file has been deleted, the disk space occupied by the file can be reused by file system. The file system can reallocate this space for data of newly created files. So the deleted file becomes overwritten. There are more chances that an overwritten file is corrupted and can not be recovered successfully. Pandora Recovery can determine if given deleted file is overwritten. It displays overwritten deleted files in red.

Note, this feature is not available with Surface Scan

 

How can I determine how much percent of a file data was overwritten by other files?

You can hold your mouse pointer over the file for a second or two until popup tip is displayed. The tip contains information about how many percent of the file were overwritten by other files. Example: "Overwritten: 50%". The more percent were overwritten, the less chances the file will be recovered successfully.

 Note, this feature is not available with Surface Scan

 

8.5         Questions About Deleted Files Search

 

How to find and display all deleted files located on disc drive?

Enter asterisk (*) in file name field and press Search button. It will display all deleted files and folders

 

How can I search for files containing video and images in Search tab?

Use following filename patterns:
1. For video: *.avi;
2. For images: *.bmp;*.jpg;*.gif;

 

What is the difference between 'Exactly' and 'Like' search criteria?

If you use 'Exactly' it will find the files having the exact same name as you've entered in filename field. But if you use 'Like' it will find the names that match search pattern you've entered in filename filled.

 

What will happen if I recover deleted files to the disc drive containing less free space than needed for complete recovery?

Some files won't be recovered. Ensure that the destination disc has enough free space for complete recovery.

 

It displays my deleted file in the Search tab, but when I choose 'Open Containing Folder' context menu item it doesn't go to file's original location and doesn't show the file in Browse tab. Why does that happen?

This can happen when Windows doesn't grant you permission to view contents of certain folder, for example of System Volume Information folder. You still can recover found deleted files from such folders from Search tab.

 

Why don't I ever see 'Orphan Folders' in Search tab?

Orphan Folders are not displayed in Search view, because they do not physically exist, but deleted files contained in them are displayed in Search view.

 

I cleared my Recycle Bin. I've tried Search but I can't find them. Where did the files from Recycle Bin disappear?

In Browse tab, open the folder called RECYCLER on the disk drive where your files were located before they were deleted. There, you will see files named like Dd123.xyz. The files you have deleted may be there. Windows automatically renames files when placing them to Recycle Bin. The problem is you can't determine the original names. Now select all files in RECYCLER folder and recover them to another disk drive. Open each recovered file to determine its content.

 

I removed files located in My Documents folder. How can I find and recover them?

Windows XP:

 1. In Browse tab, open "C:\Document and Settings\<your_user_name>\My Documents" folder. Your deleted files may be there.
 2. Try searching drive C:.

 

I removed files from desktop. How can I recover them?

Windows XP:

 1. In Browse tab, open "C:\Document and Settings\<your_user_name>\Desktop" folder. Your deleted files may be there.
 2. Try searching drive C:.

 

8.6         Questions About Quick Viewer

 

What types of files can I preview in Quick Viewer?

Currently you can preview files having several image file types (BMP, GIF, JPG, PNG, ICO,TIF, TGA, PCX, WBMP, WMF, JP2, J2K, JBG, JPC, PGX, PNM, RAS, CUR) and several text file types (TXT, LOG, INI, BAT, RTF, XML, CSS). Quick Viewer allows you preview file contents as text if it can't find appropriate viewer for it.

 

I want to preview deleted file(s) that are supported by Quick Viewer, but it doesn't show file contents and only allows you to view file as text. Why?

The deleted file(s) you are trying to preview may be overwritten. In such a case "Quick Viewer" can not display its content.

 

8.7         Questions About Disk Surface Scan

 

What is disk surface scan and how does it work?

Disk surface scan enumerates all unused clusters on the disk drive and searches for disk areas probably occupied by the data of removed files. Using this method of search, we do not use information contained in the file allocation table. So, it can work even on reformatted disk drives (except in) the case when low-level formatting was performed).

Almost each type of files has its unique features, for example the beginning of a JPEG file always contains JFIF magic word. Using this information we can determine what areas of the disk may contain deleted files data. Knowing the structure of a file (which is common within one file type) we can determine the length of the file and then recover file data.

File name and file attributes information are stored separately of the file data in file allocation table (FAT in FAT32 file system, MFT in NTFS), so we cannot determine the name of the file, its attributes, file path and recover data of file alternative data streams.

This method works only with non-fragmented files. Data of non- fragmented file(s) are stored in contiguous neighbor clusters, while data of a fragmented file may be stored in different places of the disk.

Remarks: In NTFS small files (less than 1KB in size) reside only in the Master File Table (MFT), so we cannot find such files using the Surface Scan Method.

When should I use Browse Method (Indexing Hard drive) and when should I use the Disk Surface Scan Method?

You should try the Browse (Indexing Hard Drive) method at first. Using the Browse method you can recover much more information about deleted files than using Disk Surface Scan.


For example, the disk surface scan can not recover file name, file attributes or alternative data stream data while Browse method can recover such information.

If you just don't remember where the lost file was removed from, use Browse (Index entire drive) method.

In cases where Browse (Indexing entire hard drive) doesn't give the desired results, you may try Disk Surface Scan. It works with deleted files that have no record in the file allocation table or with reformatted disk drives, where the file allocation table is empty.

 

What is better - Browse Method or Disk Surface Scan?


It depends on what your circumstances are. Look at the following table comparing advantages and disadvantages of both methods.

 

Feature

Browse Method

Disk Surface Scan Method

Recover file names, file, attributes and alternative data streams

Yes

No

Recover fragmented files

Yes

No

Recover all file types

Yes

No, only several predefined types

Recover files from discs with damaged or missing file allocation table

No

Yes

Recover files whose MFT record has been reused

No

Yes

Recover files from reformatted disk drives

No

Yes

Recover files from FAT32 disk drives, floppies or flash cards

No

No

 

Is disk surface scan applicable to reformatted disk drives?


Yes, you can recover files even from reformatted disk drives, except in cases where low-level formatting was performed.

 

What file type's can I find and recover using disk surface scan method?

Currently you can look for and recover:


- JPEG images (*.JPG).
- PNG images (*.PNG).
- GIF images (*.GIF).
- BMP images (*.BMP).
- MS Word 95-2007 (*.DOC, *.DOCX) .
- MS Excel 95-2007 (*.XLS, *.XLSX).
- MS PowerPoint 95-2007 (*.PPT, *.PPTX).
- MP3 audio files (*.MP3).
- ZIP compressed archives (*.ZIP).
- Adobe Photoshop files (*.PSD).
- MS Outlook files (*.PST).

 

Can I scan my FAT32 or NTFS disk drive?

YES. The surface scan supports both of these file system formats.

 

What information can I recover using disk surface scan method?

You are able to recover file data only using disk surface scan. File name, file attributes of file path can not be recovered using this method.

 

Why can't I see original file names using disk surface scan method?

Information about file names is stored in the Master File Table (MFT), separate from data files. The disk surface scan method enumerates all unused clusters on the disk and does not use information from MFT. Use Browse method instead if you need such information.

 

Why can't I recover file name, attributes and file path?

File name information is stored separately of the file data in file allocation table, so we cannot determine the name of the file, its attributes, and path or alternative data streams. The disk surface scan method enumerates all unused clusters on the disk and doesn't use information from MFT. This allows it to scan, even reformatted disk drives.

What do I do if I need to search for a file type, but I don't see it in the supported type's tree?

Disk surface scan allows you search for several predefined file types (JPEG, PNG, BMP or GIF, DOC and DOCX (MS Word 95-2007), XLS and XLSX (MS Excel 95-2007), PPT and PPTX (MS PowerPoint 95-2007), MP3, ZIP, PSD (Adobe Photoshop), and PST (MS Outlook files)). If you need to look for other file types you can use the browse method. If both Browse and Surface Scan have no effect, than your information was probably permanently lost.

 

9          ERROR REFERENCE

Below is a list of status messages that you might encounter while using the software. 'Error' does not indicate an error in logic or implementation of the software. Instead, it indicates an unfavorable outcome.

 

Error message: The deleted file couldn't be accessed. File record is corrupted.
Severity: Fatal.
Reason: The MFT record of the file is corrupted. File name can not be determined. File data can not be recovered.

Error message: The file couldn't be recovered. The $EFS attribute is corrupted.
Severity: Fatal.
Reason: The $EFS attribute of the encrypted file is missing or corrupted. File contents can not be recovered.

Error message: The file doesn't contain $FILE_NAME attribute.
Severity: Fatal. 
Reason: The $FILE_NAME attribute is missing or corrupted. The name of file cannot be determined.

Error message: The encrypted file couldn't be imported.
Severity: Fatal.
Reason: There was an error during the file import procedure. The encrypted can not be recovered.

Error message: Error opening file for import.
Severity: Fatal.
Reason: The EFS can not open encrypted file for importing to the file system.

Error message: The file has no $DATA attribute. The file possibly was overwritten.
Severity: Fatal.
Reason: File has no data to recover.

Error message:
The data stream couldn't be created.
Severity: Not fatal.
Reason: The alternative data stream can not be created. This may happen if you try to recover the file to non-NTFS drive.

Error message: The data stream was not completely recovered. It is possibly corrupted.
Severity: Not fatal.
Reason: Not all data can be recovered. Part of file data is missing.

Error message: The following file already exists. Do you want to overwrite it?
Severity: Not fatal.
Reason: The destination folder already contains such file.

Error message: Error overwriting file.
Severity: Fatal.
Reason: The destination file can not be overwritten. It is possibly locked by another process.

Error message: Target drive contains a file system that does not support alternative data streams. Only one stream will be recovered.
Severity:  Not fatal.
Reason: The alternative data stream can not be created. This may happen if you try to recover the file to non-NTFS drive.


Error message: X of free space are available on disk while X are needed for complete recovery. Continue anyway?
Severity:  Not fatal.
Reason: There is no enough free space on destination disc drive.



10     GLOSSARY

 

Alternative File Stream Files in NTFS can have more then one stream. Alternative streams usually contain file related metadata. For example, MP3 music file may contain unnamed stream, where data are stored, and one or several additional streams where composition genre, album name and author name are stored.

FAT32
The standard file system used in Windows 95/98/Me. It supports long file names. Now FAT32 is obsolete, but it is supported in Windows for backward compatibility. NTFS, the most modern file system, is now used by default in Windows 2000/XP/2003/
Vista. FAT32 is supported by Pandora Recovery. You can recover deleted files from FAT32 volumes.

File Attributes Each file or folder on disk has none, one or several assigned attributes, such as Archive, Hidden, System, Not Content Indexed and so on. For example a file having Hidden attribute isn't displayed in Windows Explorer view. Pandora Recovery can restore original attributes of a deleted file or folder.

File Encryption Windows 2000 introduced Encrypting File System (EFS), which supports file encryption. EFS service runs on top of NTFS and encrypts or decrypts files or folders transparently for users and applications. EFS uses DESX/3DES/AES symmetric key encryption algorithms for fast file encryption and RSA public/private key algorithm for storing the symmetric keys in secure manner.

File Recovery When you delete a file on FAT32 or NTFS file system, its content is not erased from disk but only reference to file data in File Allocation Table is marked as deleted. It means that you can recover deleted files, or make it visible for file system again.

NTFS  NTFS, or New Technology File System, supports many features not supported by FAT32, such as alternative file streams, file encryption and so on. Pandora Recovery now supports only NTFS. This means that you can recover deleted files from NTFS volumes using this software.

Stream is a part of a file. Each file has at least one stream, where its data is stored. NTFS file system introduces multiple streaming, when one file can have many streams. The main stream, or unnamed data stream, contains file data. Alternative streams usually have names and may contain additional data or metadata.

Volume Named part of physical disk. Each volume is assigned a letter, for example "C:".

11      CONTACT US

 

Highly skilled technical support is available 24/7 from our website available at http://www.PandoraRecovery.com/support/