Frequently Asked Questions

Questions About Installation
Questions About File Recovery
Questions About NTFS
Questions About Drive Indexing
Questions About Browsing
Questions About Deleted Files Search
Questions About Quick Viewer
Questions About Surface Scan
Questions About Pandora Mobile Recovery

Questions About Installation

What are the system requirements for installing Pandora Recovery?
Pandora Recovery requires Windows XP SP1 or newer or Windows Vista for installation. Pandora Recovery supports the recovery of deleted data from NTFS, FAT or FAT32 formatted drives.

There are no plans at this time to create a version compatible with the Mac, Linux, or any other non-Microsoft Operating System.

How do I install Pandora Recovery?
Simply download the installer from our website and then step through the simple installation wizard.

It is VERY IMPORTANT you do not create, modify, or edit data on the drive that your lost data resides on. This includes, but is not limited to, installing new software (such as Pandora Recovery) to the drive, running software on the drive (including your operating system), or creating new files. This file activity may cause partial or even permanent loss of your deleted data.

If your lost data resides on your C: it is STRONGLY RECOMMENDED you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer. Please consult your computer manufacturer for assistance configuring hard drives in this manner.

How do I uninstall Pandora Recovery?
To Uninstall Pandora Recovery please do the following:
1. Click the Start button.
2. Click All Programs.
3. Click Pandora Recovery.
4. Click on Uninstall and then follow the step by step instructions.
5. Or use Add/Remove Programs as found in your Control Panel.

Questions About File Recovery

I have deleted very important information. What should I do to keep it safe from corruption?
It is VERY IMPORTANT you do not create, modify, or edit data on the drive that your lost data resides on. This includes, but is not limited to, installing new software (such as Pandora Recovery) to the drive, running software on the drive (including your operating system), or creating new files. This file activity may cause partial or even permanent loss of your deleted data.

I removed my file(s) from my C: drive five minutes ago, but I can't find them. Is this Pandora Recovery fault? This is probably not the fault of Pandora Recovery. Here are possible reasons why this could happen:
1. Your deleted files were located on your system drive C: and your operating system or other application reused the MFT records belonging to your deleted files. In this case Pandora Recovery can't find your files.
2. Your deleted files may still reside in Recycle Bin while you are thinking they are deleted. Check your Recycle Bin to ensure they were really deleted.
3. If your files were deleted from the Recycle Bin (you have emptied the Recycle Bin), please do the following. Under the Browse tab, open the folder called RECYCLER on the disk drive where your files were located before they were deleted. There you will see files named like Dc123.xyz. The files you have deleted may be within them. Windows automatically renames files when placing them in the Recycle Bin. The problem is that you can't determine the original names. Now select all files in RECYCLER folder and recover them to another disk drive. Open each recovered file to determine its content.

I removed my files a year ago and just now realized that. Will I be able to recover them with Pandora Recovery?
Unfortunately, the success of file recovery highly depends on the time since you removed your files. When you remove a file, the space occupied by its data is marked as unused. The operating system constantly reuses the unused space when it creates new files or changes (writes to) existing files. The answer to your question depends on how frequently and how long you worked with your disk drive. Frequent file creation/write operations will highly reduce the chances of finding and recovering your files. Do not forget that your operating system itself constantly creates temporary files, so if your data is stored on your system drive (C:\) there is less probability that you will be able to recover them.

Nevertheless, it won't hurt to try to find and recover your files.
1. The recommended method is to use the search tab. Enter the name of your file and press the Search button. All deleted files matching your criteria will be displayed in the list in the bottom of the window.
2. If the search doesn't help (you can't see your deleted file in the search results list), you can try the disk surface scan method. This will help if you are looking for files of the following types: JPEG, PNG, BMP or GIF, DOC and DOCX (MS Word 95-2007), XLS and XLSX (MS Excel 95-2007), PPT and PPTX (MS PowerPoint 95-2007), MP3, ZIP, PSD (adobe photoshop), and PST (MS Outlook files). We plan to expand the list of supported formats in future versions. Click the Surface Scan tab. Choose the type of the file you want to search for, and click the Start Surface Scan button.

I reformatted the disk drive. Can I recover information from it using Pandora Recovery?
Pandora Recovery's surface scan supports the following file types: JPEG, PNG, BMP or GIF, DOC and DOCX (MS Word 95-2007), XLS and XLSX (MS Excel 95-2007), PPT and PPTX (MS PowerPoint 95-2007), MP3, ZIP, PSD (adobe photoshop), and PST (MS Outlook files). If the file you are trying to recover is of one of these types, you may be able to recovery it even after a disk has been reformatted.

How can I recover deleted emails?
Pandora Recovery can find and recover deleted files and folders from your drive. This could include recovery of deleted email. But this is likely only possible if you've deleted the entire email program or formatted your drive. First you need to understand how most email programs store and manage your email. Each email is not a unique file stored individually on your hard drive like a word processing document. Instead the email program creates and maintains a large database and each email is simply an entry within this large database. When you receive a new email a new entry in the database is created. When you delete an email that entry is then removed from the database. But the database file itself continues to exist the entire time. Thus recovery of a deleted email within the database is extremely unlikely, at least with Pandora Recovery. However, if you happened to delete the database, removed the entire email program (which would also likely remove the database), or formatted your hard drive (which deletes everything on the drive) then Pandora Recovery can likely locate the deleted file and recover it for your use.

What file systems are supported by Pandora Recovery?
Currently Pandora Recovery supports the NTFS, FAT and FAT32 file systems. You can recover deleted files only from disc drives that are formatted using the above listed file systems.

Can I recover deleted files from the disk formatted using FAT32 file system?
Yes. This version of Pandora Recovery allows you recover deleted files from FAT/FAT32 formatted drives.

Should I recover file attributes and alternative data streams?
Yes, this usefull information should be recovered. Alternative streams often contain file metadata, while file attributes contain information about how files are displaed in Windows Explorer.

Why cannot I recover alternative data streams to a FAT32-formatted disc drive?
FAT32 does not support alternative streams. When you try to recover a file containing more than one stream, only its unnamed data stream will be recovered.

Why shouldn't I recover deleted files to the same disc drive they are originally located?
The data of newly created files may overwrite the data of deleted files. That may cause permanent loss of data.

Where should I recover my deleted files to?
To increase the success of file recovery it is strongly recommended that you recover your deleted file(s) to a secondary hard drive, a network drive, USB flash drive, or other external media. While recovery to the same drive that the deleted file(s) reside on is physically possible it may lead to partial or permanent loss of your deleted content. Non-deleted file(s) will never be put at risk in either circumstance.

When I recover a group of deleted files or folders with similar names, it renames some of them. Why so?
Files within one folder must have unique names. This condition is not always true for deleted files. By that reason Pandora Recovery renames the files to make their names unique within a folder.

I have many deleted files with the same names. How can I determine which one I need to recover?
You can recover all files and then open each one using appropriate application. By opening each file you can determine which one you need by its content.

Can I recover an encrypted file using Pandora Recovery?
Yes, Pandora Recovery allows you recover files encrypted by EFS, the Encrypting File System.

How does Pandora Recovery recover encrypted files? Does it decipher them?
Pandora Recovery does not decipher contents of encrypted files. Instead of that it copies the content of an encrypted file in raw mode just like data back-up applications do.

Can I recover encrypted files belonging to other users?
You can not recover encrypted files that are owned by other users.

I have recovered an encrypted file, but it contains junk. Why could this happen?
This may happen due to any of following reasons:
1. The contents of the file was overwritten by other files;
2. The $EFS attribute of the file was corrupted;
3. If you recover files that are owned by another user, EFS can't decipher its content.

Questions About NTFS

In what operating systems NTFS is used?
NTFS is the default file sytem in all modern operating systems from Microsoft, such as Windows 2000, Windows XP and Windows Vista.

What are $DATA and $FILE_NAME attributes?
Do not confuse NTFS file attributes with Archive, Hidden, System (and others) attributes. The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. $FILE_NAME attribute contains information about file's name, creation/modification date and so on. $DATA attribute may contain data of file's unnamed or alternative data stream. Learn more about NTFS attributes in NTFS File Types article on www.ntfs.com.

What is an alternative file stream?
In NTFS all files have at least on file stream also called the unnamed $DATA stream. The unnamed stream contains the actual data of the file. Alternative streams usually contain file-related metadata. For example, MP3 music file may contain unnamed stream, where data are stored, and one or several additional streams where composition genre, album name and author's name are stored.

What are Archive, Hidden, System (and others) file attributes?
Each file or folder on disk has none, one or several assigned attributes, such as Archive, Hidden, System, Not Content Indexed and so on. For example a file having Hidden attribute isn't displayed in Windows Explorer view. Pandora Recovery can restore original attributes of a deleted file or folder. Do not confuse such file attributes with NTFS file attributes ($DATA, $FILE_NAME and so on).

What is $EFS attribute?
$EFS attribute contains information needed by EFS, the Encrypting File System, to decipher contents of an encrypted file. If $EFS attribute is missing or corrupted, the file can't be decrypted.

Questions About Drive Indexing

What happens when Pandora Recovery indexes my drive?
When indexing, Pandora Recovery collects information from your disk's file allocation table (MFT, the Master File Table). MFT contains information about both existing and deleted files. Pandora Recovery creates index of all deleted files in memory and can save indexing information to disk for later use.

Why can't it index my CD-ROM disc and my floppy disk?
Your CD-ROM disc is formatted in CDFS file system, and your floppy disk has FAT12 file system. Both CDFS and FAT12 are not supported by this version of Pandora Recovery.

What is the difference between physical disk and logical disk?
The physical disk is the hardware located inside of your computer. When you install operating system on your computer, you can create one or several logical discs on one physical disc. Logical discs usually have a letter assigned, for example, C:

What happens if I uncheck 'Save drive indexing cache to disk' flag in General tab of Options dialog?
Pandora Recovery saves drives indexing information as hidden files to its installation directory. It is done to switch between discs more quickly and to not index disc each time you choose to open its content in Browse tab. If you uncheck this flag, Pandora Recovery won't save indexing information to disc. But it will require more time when you switch between discs in Browse tab due to it reindexing the drive each time you switch to viewing it.

Why does Pandora Recovery collect data from my drive C: much faster than from my drive D:?
The speed of drive indexing depends on the number of deleted files on your disk drive. The more deleted files there are, the slower Pandora Recovery will index your drive. Average indexing time shouldn't exceed a couple of minutes. If the software indexes your drive much slower or even freezes, please contact our support center available at http://www.pandorarecovery.com/contact and we will be happy to help you with your problem.
The speed of drive indexing may also depend on your drive's speed

Questions About Browsing

Why are some of disc drives are grayed? Can I open their contents?
No, you can not open contents of grayed disc drives because they are formatted using file system other than NTFS, FAT or FAT32.

What happens when I click 'Show Deleted Items Only' toolbar button?
When you press this button Pandora Recovery hides all folders that do not contain deleted files and shows only deleted files in current folder.

What files are contained in 'Orphan Folders' seen in root folder of my disk?
Orphan Folders can contain deleted files only. These are deleted files where the original source location cannot be determined.

Can orphan folders be recovered?
Yes, you can recover contents of an Orphan Folder.

Where do 'Orphan Folders' appear from?
During indexing Pandora Recovery tries to reconstruct the original location of deleted files. In several cases it is impossible. In such cases deleted files are placed to virtual deleted folders called Orphan Folders. Orphan Folders are always placed to the root folder of the disc to be quickly accessed by you.

Why some files are displayed in green and blue?
Compressed files are displayed in blue and encrypted files are displayed in green. Pandora Recovery allows you to recover all kinds of files from volumes formatted using NTFS, including compressed, sparse and encrypted files.

Why some files are displayed in red?
Overwritten deleted files are displayed in red color. When a file has been deleted, the disk space occupied by the file can be reused by file system. The file system can reallocate this space for data of newly created files. So the deleted file becomes overwritten. There are more chances that an overwritten file is corrupted and can not be recovered successfully. Pandora Recovery can determine if given deleted file is overwritten. It displays overwritten deleted files in red.

Why are some files displayed in gray?
Files having 'hidden' attribute are displayed in gray . Such files are usually not displayed in Windows Explorer. This is why they are called hidden files. Pandora Recovery allows the recovery of hidden files.

How can I determine what percent of a file's data has been overwritten by other files?
You can hold your mouse pointer over the file for a second or two until popup tip is displayed. The tip contains information about what percent of the file is overwritten by other files. Example: "Overwritten:50%". The higher percent is overwritten, the less chances the file will be recovered successfully.

Questions About Deleted Files Search

How to find and display all deleted files located on disc drive?
Enter asterisk (*) in the filename field and press Search button. It will display all deleted files and folders found on the drive searched.

How can I search for files containing video and images in Search tab?
Search using the file type extension. For example, use following filename patterns:
1. For video: *.avi; *.mpg; *.mov
2. For images: *.bmp;*.jpg;*.gif;

What is the difference between 'Exactly' and 'Like' search criteria?
If you use 'Exactly' it will find the files having exactly the same name as you've entered in filename field. But if you use 'Like' it will find the names that match search pattern you've entered in filename field.

What will happen if I recover deleted files to the disc drive containing less free space than needed for complete recovery?
Some files won't be recovered. Ensure that the destination disc has enough free space for complete recovery.

It displays my deleted file in Search tab, but when I choose 'Open Containing Folder' context menu item it doesn't go to file's original location and doesn't show the file in Browse tab. Why does that happen?
This can happen when Windows doesn't grant you permission to view contents of certain folder, for example the System Volume Information folder. You still can recover found deleted files from such folders from Search tab.

Why do I never see 'Orphan Folders' in Search tab?
Orphan Folders are not displayed in Search view, because they do not physically exist, but deleted files containing in them are displayed in Search view.

I cleared my Recycle Bin. I've tried Search but I can't find them. Where did the files from Recycle Bin disappear to?
In Browse tab, open the folder called RECYCLER on the disk drive where your files were located before they were deleted. There you will see files named like Dd123.xyz. The files you have deleted may be within them. Windows automatically renames files when placing them to Recycle Bin. The problem is you can't determine the original names. Now select all files in RECYCLER folder and recover them to another disk drive. Open each recovered file to determine its content.

I removed files located in My Documents folder. How can I find and recover them?
Windows XP:

1. In Browse tab, open "C:\Document and Settings\<your_user_name>\My Documents" folder. Your deleted files may be there.
2. Try a search drive C:.

I removed files from desktop. How can I recover them?

Windows XP:

1. In Browse tab, open "C:\Document and Settings\<your_user_name>\Desktop" folder. Your deleted files may be there.
2. Try a search of drive C:.

Questions About Quick Viewer

What types of files can I preview in Quick Viewer?
Currently you can preview files having several image file types (BMP, GIF, JPG, PNG, ICO,TIF, TGA, PCX, WBMP, WMF, JP2, J2K, JBG, JPC, PGX, PNM, RAS, CUR) and several text file types (TXT, LOG, INI, BAT, RTF, XML, CSS). Quick Viewer allows you preview file contents as text if it can't find appropriate viewer for it.

I want to preview deleted file that has type supported by Quick Viewer, but it doesn't show file contents and only allows to view file as text. Why so?

The deleted file you are trying to preview may be overwritten. In such case Quick Viewer can not display its content.

Questions About Surface Scan

What is disk surface scan and how does it work?

Surface Scan - Embedded Image Preview
Click Image to Enlarge

Disk surface scan enumerates all unused clusters on the disk drive and searches for disk areas probably occupied by the data of removed files. Using this method of search, we do not use information contained in the file allocation table. So, it can work even on reformatted disk drives (except in) the case when low-level formatting was performed).

Almost each type of files has its unique features, for example the beginning of a JPEG file always contains JFIF magic word. Using this information we can determine what areas of the disk may contain deleted files data. Knowing the structure of a file (which is common within one file type) we can determine the length of the file and then recover file data.

File name and file attributes information are stored separately of the file data in file allocation table (FAT in FAT32 file system, MFT in NTFS), so we cannot determine the name of the file, its attributes, file path and recover data of file alternative data streams.

This method works only with non-fragmented files. Data of non- fragmented file(s) are stored in contiguous neighbor clusters, while data of a fragmented file may be stored in different places of the disk.

Remarks: In NTFS small files (less than 1KB in size) reside only in the Master File Table (MFT), so we cannot find such files using the Surface Scan Method.

When should I use Browse Method (Indexing Hard drive) and when should I use the Disk Surface Scan Method?

You should try the Browse (Indexing Hard Drive) method at first. Using the Browse method you can recover much more information about deleted files than using Disk Surface Scan.

For example, the disk surface scan can not recover file name, file attributes or alternative data stream data while Browse method can recover such information.

If you just don't remember where the lost file was removed from, use Browse (Index entire drive) method.

In cases where Browse (Indexing entire hard drive) doesn't give the desired results, you may try Disk Surface Scan. It works with deleted files that have no record in the file allocation table or with reformatted disk drives, where the file allocation table is empty.

What is better, Browse Method or Disk Surface Scan?

It depends on what your circumstances are. Look at the following table comparing advantages and disadvantages of both methods.

Feature	Browse Method	Disk Surface Scan Method
Recover file names, file, attributes and alternative data streams	Yes	No
Recover fragmented files	Yes	No
Recover all file types	Yes	No, only several predefined types
Recover files from discs with damaged or missing file allocation table	No	Yes
Recover files whose MFT record has been reused	No	Yes
Recover files from reformatted disk drives	No	Yes
Recover files from FAT32 disk drives, floppies or flash cards	No	No

Is disk surface scan applicable to reformatted disk drives?

Yes, you can recover files even from reformatted disk drives, except in cases where low-level formatting was performed.

What file types can I find and recover using disk surface scan method?

Currently you can look for and recover:

- JPEG images (*.JPG).
- PNG images (*.PNG).
- GIF images (*.GIF).
- BMP images (*.BMP).
- MS Word 95-2007 (*.DOC, *.DOCX) .
- MS Excel 95-2007 (*.XLS, *.XLSX).
- MS PowerPoint 95-2007 (*.PPT, *.PPTX).
- MP3 audio files (*.MP3).
- ZIP compressed archives (*.ZIP).
- Adobe photoshop files (*.PSD).
- MS Outlook files (*.PST).

Can I scan my FAT32 or NTFS disk drive?

YES. The surface scan supports both of these file system formats.

What information can I recover using disk surface scan method?

You are able to recover file data only using disk surface scan. File name, file attributes of file path can not be recovered using this method.

Why can't I see original file names using disk surface scan method?

Information about file names is stored in the Master File Table (MFT) separate from the actual file data. The disk surface scan method enumerates all clusters on the disk that are marked as unused. It can't use the file name information from MFT.

Howerer, several file types, for example MP3 files or Microsoft Office Documents, store some file information inside of file data stream. So even not analyzing MFT, we can determine file properties and create friendly file names for such file types. For example, "User - Sample Office Document.doc".

Some file types, such as BMP and GIF have no ability to store properties inside of the data stream. For such files, we generate unique names based on the file's starting cluster number. For example, "GIF Animation (23523).gif".

Why can't I recover file name, attributes and file path?

File name information is stored separately of the file data in file allocation table, so we cannot determine the name of the file, its attributes, and path or alternative data streams. The disk surface scan method enumerates all unused clusters on the disk and doesn't use information from MFT. This allows it to scan, even reformatted disk drives.

What do I do if I need to search for a file type, but I don't see it in the supported type's tree?

Disk surface scan allows you search for several predefined file types (JPEG, PNG, BMP or GIF, DOC and DOCX (MS Word 95-2007), XLS and XLSX (MS Excel 95-2007), PPT and PPTX (MS PowerPoint 95-2007), MP3, ZIP, PSD (adobe photoshop), and PST (MS Outlook files)). If you need to look for other file types you can use the browse method. If both Browse and Surface Scan have no effect, than your information was probably permanently lost.

Why does Pandora Recovery scans my disk drive so slowly? What factors affect scan time?
The possible factors are:
1. The reading speed of your disk drive;
2. Size of your disk drive;
3. Amount of free space available on your disk drive. It will scan drives with more free space much slower than almost full disk drives.

Questions About Pandora Mobile Recovery

Can I copy Pandora Recovery from the original media to another disk drive and run it?
No, Pandora Recovery won't work on another disk drive.

Why does Pandora Recovery works so slow when I launch it from removable media?
The speed depends on speed (read/write speed) of your removable media. The slower your media, the slower Pandora Recovery works.

Why is there no Update tab in the Options dialog? Can I install updates for Pandora Recovery on my removable media?
No, you can't install updates for Pandora Recovery distributed on removable media.