Pandora Recovery allows you to find and recover recoverable deleted files
from NTFS and FAT-formatted volumes. Pandora Recovery will scan your hard
drive and build an index of existing and deleted files and directories
(folders) on any logical drive of your computer with supported file format.
Once the scanning is complete you have full control over which files to
recover and what destination to recover them to. You can BROWSE the hierarchy
of existing and deleted files, or you can use SEARCH functionality to
find a deleted file if you remember at least one of the following:
- full or partial file name,
- file size,
- file creation date, or
- file last accessed date
On top of that, Pandora Recovery allows you to preview deleted files of certain type (images and text files) without performing recovery. This feature becomes really important if you are forced to recover deleted files to the same drive. Currently you can preview files having several image file types (BMP, GIF, JPG, PNG, ICO,TIF, TGA, PCX, WBMP, WMF, JP2, J2K, JBG, JPC, PGX, PNM, RAS, CUR) and several text file types (TXT, LOG, INI, BAT, RTF, XML, CSS). Quick Viewer allows you preview file contents as text if it cannot find appropriate viewer for it. To use quick viewer you can select deleted file and or click the Quick Viewer icon or right click on deleted file and select 'Quick View'. Quick View will then display a preview of deleted file.
Finally, Pandora Recovery allows you to recover deleted files, without any limitations on application's end. Note that successful recovery might not be possible - if the original location has been reused by operating system to store different content the integrity of the original content has not been preserved and the recovered data will most likely be corrupted.
Disk surface scan enumerates all unused clusters on the disk drive and searches for disk areas probably occupied by the data of removed files. Using this method of search, we do not use information contained in the file allocation table. So, it can work even on reformatted disk drives (except in) the case when low-level formatting was performed).
Almost each type of files has its unique features, for example the beginning of a JPEG file always contains JFIF magic word. Using this information we can determine what areas of the disk may contain deleted files data. Knowing the structure of a file (which is common within one file type) we can determine the length of the file and then recover file data.
File name and file attributes information are stored separately of the file data in file allocation table (FAT in FAT32 file system, MFT in NTFS), so we cannot determine the name of the file, its attributes, file path and recover data of file alternative data streams.
This method works only with non-fragmented files. Data of non- fragmented file(s) are stored in contiguous neighbor clusters, while data of a fragmented file may be stored in different places of the disk.
Remarks: In NTFS small files (less than 1KB in size) reside only in the Master File Table (MFT), so we cannot find such files using the Surface Scan Method.
Pandora Recovery can recover not only 'regular' files, but also archived, hidden, system, sparse, encrypted and compressed files.
Windows 2000 introduced Encrypting File System (EFS), which supports file encryption. EFS service runs on top of NTFS and encrypts or decrypts files or folders transparently for users and applications. Pandora Recovery does not decipher contents of encrypted files. Instead of that it copies the content of an encrypted file in raw mode just like data back-up applications do.
Encrypted and compressed files will be color-coded once drive indexing has been completed. Names of the encrypted files will be displayed in GREEN, while compressed files will be BLUE.
Pandora Recovery handles files regardless of their type, size or any other attribute. As long as the space on the logical drive has not been reused by operating system Pandora Recovery can successfully recover content of any deleted file.
If you want to search for unspecified deleted images or movies the best
strategy is to search for common file extensions:
- *.avi, *.mpg, *.mov for video
- *.bmp, *.jpg, *.png, *.gif for images
If clusters once used by a file have been reused by another already deleted files Pandora Recovery will display 0% as 'overwritten' value, which means the clusters are not currently in use. Still, the recovered data is likely to be corrupted.
Pandora Recovery gives you an estimate of recovery success by displaying the percent of clusters reused by operating system. To view the estimate move the mouse pointer over a file for a second or two until popup tip is displayed. The tip will say "Overwritten: 50%" or "Overwritten: 0%" . The higher the percent, the lower the chance of successful recovery.
Names of files with partially or completely overwritten clusters are displayed in RED.
Pandora Recovery displays properties of files: file type, deletion status, percent of clusters reused ('overwritten' attribute), path and size of the file, date created and date modified and common attributes (compressed, archived, hidden, system, encrypted...). To display file properties you should right-click on a file and select 'Properties' from context menu.
Pandora Recovery also displays properties of available logical drives: Drive letter, volume label, type, file system, total and available size. To display drive properties you should right-click on a logical drive and select 'Properties' from context menu.
Pandora Recovery can use local hard drive, remote network drive or flash
drive as a recovery destination folder. Pandora Recovery even allows you
to recover deleted files on the same drive that the deleted files resided
IMPORTANT! To increase the success rate of file recovery it is strongly recommended that you recover your deleted file to a secondary hard drive, a network drive, USB Flash drive, or other external media. While recovery to the same drive that the deleted files reside on is physically possible it may lead to partial or complete loss of your deleted content. Non-deleted files will never be put at risk in either circumstance.
If your lost data resides on your C: it is recommended you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer.
NTFS (New Technology File System) is the default file system in all modern operating systems from Microsoft, such as Windows NT, Windows 2000, Windows XP and Windows Vista. NTFS 5.0 is improved version of NTFS introduced with Windows 2000.
NTFS replaced Microsoft's previous FAT file system, used in MS-DOS and
early versions of Windows. NTFS has several improvements over FAT such
as improved support for metadata and the use of advanced data structures
to improve performance, reliability, and disk space utilization plus additional
extensions such as security access control lists and file system journaling.
The exact specification is a trade secret, although (since NTFS v3.00)
it can be licensed commercially from Microsoft through their Intellectual
Property Licensing program.
NTFS5 (where 5 comes from internal enumeration of Windows 2000, the operating system which first implemented NTFS v.3.00) includes several new features over its predecessors: disk usage quotas, sparse file support, reparse points, distributed link tracking and file-level encryption, also known as the Encrypting File System (EFS).
FAT16 based on the usual 512 byte sector size and used with MS-DOS and Windows 3.xx, has a maximum partition size of 2 Gigabytes. FAT16 does not natively support alternate data streams or file permissions and it is not a journaling file system.
FAT32 was introduced with Windows 95. It is the standard file system used in Windows 95/98/Me. The theoretical Maximum partition size for the FAT32 file system is 8 Terabytes. However, in Windows 95 and 98 the size is limited to 127.53GB because to the disk 16-bit disk utilities included with the operating systems. Windows 2000 and later operating systems should be able to support the theoretical maximum size of FAT32, but Microsoft has placed an artificial limit which only allows formatting up to 32GB volumes on Windows 2000 and XP. The Maximum file size that can exist on a FAT32 formatted partition is 4GB. This has become a major factor in rendering the FAT32 file system obsolete for use on a personal computer hard drive. Media files can easily exceed this maximum size. FAT32 does not natively support alternate data streams or file permissions and it is not a journaling file system.
easy way to get started in recovery your deleted files is by using the
Wizard. By default the Wizard will open automatically when you start Pandora
Recovery. You can also access the Wizard by clicking on the wizard icon
in the program toolbar.