Prosoft Eng Data Rescue Operation Manual

Table of Contents

1 Introduction

1.1 Welcome

1.2 Latest Version of the Software

1.3 Contact Prosoft Engineering

1.4 System Requirements

1.5 General Usage

1.6 Basic Recovery Tips

1.7 Drives With Suspected Hardware Problems

1.7.1 If your drive is not visible in Data Rescue

2 Installing and Starting Data Rescue

2.1 Install Data Rescue

2.2 Before you start Data Rescue

2.2.1 Note on Data Rescue's Temporary Storage Location

2.3 Starting Data Rescue

2.4 Activation

2.4.1 Where is my serial number?

3 Using Data Rescue

3.1 Welcome to Data Rescue

3.2 Selecting a Drive to Scan

3.2.1 Add File to Scan

3.3 Choose a Scan Task

3.4 Step 3: Find and Mark Files

3.4.1 Previewing Files

3.4.2 Searching the Scan Results

3.4.3 Recovering Files

4 Create Recovery Drive

5 Tasks

5.1 Quick Scan

5.2 Deep Scan

5.3 Clone

6 Manage Custom File Modules

6.1 FileIQ Advanced Options

6.2 FileIQ Troubleshooting

7 Preferences

7.1 General

7.2 Preview

7.3 Notifications

7.4 Scan Engine

7.4.1 File Modules

7.4.1.1 Top Level File Modules Preferences

7.4.1.2 Category Level Preferences

7.4.1.3 File Module Preferences

7.5 Recovery Preferences

7.6 Scanning Preferences

7.7 Drive Failure Detection

8 Professional Mode

8.1 View Hex

8.1.1 Template

8.2 Set Drive Parameters

8.3 Scan Management

8.3.1 Export Scan

8.3.2 Import Scan

8.3.3 Delete Scan

8.3.4 Assign Drive

8.4 Add Virtual RAID

8.5 Recover Options

8.6 Secure Erase Tool

8.7 Number Sectors Tool

8.8 Allocation Blocks Layout

8.8.1 Canceling a Scan

9 Frequently Asked Questions

10 Glossary

11 Supported File Types

12 Release Notes

Installing and Starting Data Rescue Table of Contents

1 Introduction

1.1 Welcome

Thank you for using Data Rescue.

Prosoft Engineering’s Data Rescue is an easy-to-use utility to help you recover files and folders from crashed or
corrupted hard drives or removable media. Recovered data is saved to another medium, leaving the original disk
untouched.

1.2 Latest Version of the Software

The downloads section on our web site https://www.prosofteng.com/downloads/ always has the latest version of this
software. If you already have a copy of Data Rescue installed and an active internet connection, Data Rescue will
inform you when an update is available when launching the program. If you do not have the latest version of Data
Rescue, download it from the URL above.

1.3 Contact Prosoft Engineering

Our technical support is free and can be accessed online:

Website: https://www.prosofteng.com/support/

1.4 System Requirements

Application requirements:

Mac: macOS 10.10 or later

PC: Windows 7 or later

A second drive to store recovered files*

* This drive must have free space for recovered files, plus 2% the size of the drive or volume to be scanned.

1.5 General Usage

Data Rescue was designed to be used in a wide range of situations. Specifically, Data Rescue can handle:

Any type of media which appears as a disk device (hard disk, solid state drive, SD camera cards, etc)

Volumes which can’t be mounted, even if the driver is damaged

Disks with a damaged partition map

SATA, USB, Thunderbolt, FireWire, SCSI, IDE (also called ATA or PATA drives), even floppy drives

HFS/HFS+, NTFS, and FAT32 formatted partitions

Large volumes (1 TB and larger)

Password-protected volumes (if data is not scrambled/encrypted)

Non-Roman-script (e.g. Japanese) file names

Be aware that you need disk space on another device for Data Rescue’s temporary working space, and to recover your
data. This must be a separate drive from the drive you are trying to recover from, in order to avoid altering that drive.
Data Rescue offers the most extensive, safe recovery of your important data. Because your corrupt drive is not stable,
Data Rescue will not allow you to try and save files to the same drive, nor will Data Rescue try and “repair” that corrupt
drive (doing so could actually cause more corruption and data loss).

1.6 Basic Recovery Tips

This section will provide you basic tips to help you improve your chances of recovering your data before using Data
Rescue.

Prevent writing to the hard drive. Once you are aware you are missing data, immediately quit all programs you are
using and turn off the computer. Further writing to the hard drive may overwrite data you are trying to recover. This
includes creating new documents, browsing the Internet, or running disk repair utilities to attempt to fix the drive.

Evaluate the situation. Every data recovery scenario is different and may require different approaches to recover the
data. Read “Installing and Starting Data Rescue” to determine the best method for recovering data in your situation.

Installing and Starting Data Rescue

A second hard drive with adequate space is necessary to recover data and host Data Rescue’s storage
location. If you have a second internal hard drive in your computer or an external USB/FireWire hard drive attached to

your computer, you may use it for this purpose. Make sure you have enough free space to hold the data you wish to
recover, plus an additional amount of 2% the size of the volume or disk being scanned. For example, if you need to
recover 25GB of data from the bad hard drive, you will need at least 25GB for the recovered files and 0.5GB of free
space for the storage location. In certain situations, recovered files will require more space than they occupied on the
original drive.

Consider acquiring a replacement hard drive. If you do not have a second hard drive to recover to, you may want to
acquire a new hard drive. If your hard drive is physically failing, a replacement hard drive will be necessary to maintain
your data. Not only will the new hard drive help you with your recovery immediately, but the new hard drive may also
be used as a backup hard drive in the future when your recovery is complete.

1.7 Drives With Suspected Hardware Problems

Even though Data Rescue exercises caution to never damage your drive’s data by writing to it, there are certain types
of drive hardware failures which due to their nature can cause additional damage to the media and data just by
continuing to use the drive.

One example of this kind of damage is a crashed disk head, which could potentially cause additional media scratching
and data loss with continued use. One clue to this type of damage may be unusual mechanical sounds emanating from
the drive. If you suspect this type of damage, and the data on the disk is extremely critical, you may wish to send your
drive to a professional drive recovery service with clean-room facilities.

The cost of professional recovery services can run into the thousands of dollars. If you suspect hardware damage, but
need to avoid the expense of the professional services, you can minimize the chances of further damage to your drive
by first cloning it to a spare drive, then do the recovery on the clone.

1.7.1 If your drive is not visible in Data Rescue

If you don’t see your hard drive displayed in Data Rescue’s list of drives, please review the checklist below:

For external drives:

Power cord (if required) is connected to a working outlet

Data cable (USB, FireWire, etc.) is connected to a working port

Data cable and power cord are known to be in working condition

Status lights (if any) are active

For internal drives:

Data cable (SATA, etc.) is connected to a working internal slot/port

Power cable is connected to a working power supply

Note that on macOS High Sierra or later, Data Rescue is unable to scan your main drive directly due to Apple’s

restrictions on the operating system

If your hard drive is still not visible in Data Rescue or is making clicking noises, there may be a hardware problem
affecting the drive from being recognized by the computer. Prosoft Engineering’s The Data Rescue Center may be able
to help you recover data from your hard drive.

For Software Technical Support:

https://www.prosofteng.com/support/

To Inquire about Data Recovery Services:

https://TheDataRescueCenter.com

Table of Contents

Introduction Using Data Rescue Table of Contents

2 Installing and Starting Data Rescue

This chapter provides basic instructions on installing and starting Data Rescue. If you are using Data Rescue for the
first time, you should read this chapter in detail.

2.1 Install Data Rescue

If you plan on installing Data Rescue to a disk, you should avoid installing it on the disk you are trying to recover files
from. If you are trying to recover files from a disk that you normally use as a boot drive, you will need to either boot
from the Data Rescue Recovery Drive, or else set up a different drive to boot from and install Data Rescue on that
drive. You may install Data Rescue on your recover disk or storage location disk and run it from there. It does not
necessarily have to be installed on or run from your boot disk.

Caution: avoid installing or copying Data Rescue on (or make any other changes to) a volume from
which you want to recover files. Doing so may reduce the chances of recovering files from that volume.

2.2 Before you start Data Rescue

Data Rescue requires access to a safe location for its scan files and to store your recovered files. In the interests of
performance, your best option is to plug in an external, freshly formatted hard drive, or to use a separate internal drive.
Make sure the capacity of this drive is great enough to contain all the files you plan to recover from your damaged hard
drive, plus space for Data Rescue’s temporary storage files.

It is not recommended to try and use a slow drive such as a network drive, USB 1/2 drive, etc. for temporary storage
because doing so will have a severe performance impact on Data Rescue.

2.2.1 Note on Data Rescue’s Temporary Storage Location

What is the Temporary Storage Location?

The temporary storage location is a drive, or a folder on a drive, that is used during a scan to store persistent
information found during a scan.

Choosing a Location

Data Rescue will automatically choose the storage location for you, unless there is not enough free space remaining.

While selecting a scan task, Data Rescue will determine if the current storage location is valid. If it is not valid, you will
be required to choose a new location. When prompted you will be taken to the Temporary Storage Location window.
Here you will be presented with a list of all potential locations.

Valid and Invalid Locations

Not all locations will be valid choices. A potential location must:

be located on a separate physical drive from the drive selected for scanning

contain a valid writable file system

have enough free space to store information about the drive selected for scanning. This value is estimated to be

2% of the selected drive’s capacity.

2.3 Starting Data Rescue

Launch the application by double-clicking the Data Rescue icon. If Data Rescue has not been run before, an
authentication window may be displayed. This prompt authorizes Data Rescue to access your drives with special
privileges. Enter the username and password of an Administrative user. If you are the only user of your system, then
you are most likely the administrative user, and you can use your own name and password. If you do not have an
administration password for your computer, please contact your system administrator to log in for you.

2.4 Activation

To use Data Rescue it must be activated with a serial number. To obtain a serial number, please visit

https://www.prosofteng.com/data-rescue-recovery-software/.

2.4.1 Where is my serial number?

Introduction Using Data Rescue

If you purchased Data Rescue from Prosoft’s website, your serial number will be listed in the “Order Confirmation”
email sent to you. If you have lost or deleted the email, please contact Prosoft.

If you purchased Data Rescue through a reseller, your serial number will be on the physical package itself or the
invoice. Prosoft does not have your serial number or information to look it up. Please contact the reseller for more
information.

Table of Contents

Installing and Starting Data Rescue Create Recovery Drive Table of Contents

3 Using Data Rescue

3.1 Welcome to Data Rescue

After Data Rescue starts up, the Welcome screen will be shown.

Start Recovering Files Choose this option if you want to begin scanning a drive. This will be the case for the

majority of users who haven’t used Data Rescue before.

View Previous Scan Results If you have a completed scan, this will bring you to the scan results where you

can locate files for recovery. Make sure you have the original drive that was being scanned connected to your

computer.

Clone

Create Recovery Drive Only availble for macOS when booted in a normal Mac desktop environment. See

Create Recovery Drive for more information.

3.2 Selecting a Drive to Scan

The first step is to select the drive that is missing the files. This step shows a list of all the disk drives that Data Rescue
can see on the system.

Data Rescue shows a two-level list of all the disk drives and volumes. The first level shows the hardware names of the
whole drive, which may include the make and/or model of the hard drive. This will scan the entire drive with any
partitions. The second level shows the partitions that belong to the drive. In most cases, you will want to select the
partition first if it is available.

The following lists will help you determine what to select based on your situation.

Select the drive name if:

The partition is not listed

The drive was reformatted or repartitioned

No data is found by a Quick Scan on the partition

Select the partition name if:

You are looking for deleted files

The partition failed to mount, but shows in the list

3.2.1 Add File to Scan

Add File to Scan, accessible from the File menu, allows a file to be added to the source list and enables the file to be

scanned for any additional data that is a part of the file. This feature is especially helpful to help recover from damaged
disk images that fail to mount.

To add a file to scan:

1. In the Source step, select File > Add File to Scan.

2. Browse for and select the file you want to scan.

3. Click on Open to add the file to the Source list.

Once the file has been added to the source list, you may proceed with the standard steps to scan the file.

3.3 Choose a Scan Task

The second step is to select the scan task to perform on the volume or hard drive. This step will let you choose to scan
or clone your volume or hard drive.

To choose a task:

1. Click on the icon for the task you would like to perform.

2. Click on the Start button. Wait for the Scan process to complete.

Data Rescue provides a variety of functions to help search for the data on your hard drive. Each scan method is
designed to help recover different scenarios. See the tasks section for more information.

3.4 Step 3: Find and Mark Files

The third step is to mark the files and folders to be recovered. Marking a folder will automatically mark all the files and
folders contained within the folder.

Data Rescue will organize files into two different folders: Found Files and Reconstructed Files. The files found by Data
Rescue will be organized depending on the scan method you use.

Found Files will be listed in the results window when using a Quick Scan or Deep Scan. Found Files displays any files
from any file systems it detects, listing original directory structures and file names. You will want to look through the
Found Files results if you are recovering from a drive that has failed to boot to the operating system or if your external
drive is failing to mount.

Reconstructed Files will be listed in the results window when using a Deep Scan. The Reconstructed Files results will
organize any found files by category and file type. These results will NOT have their original directory structure and will
usually not have their original file names since they are found by file patterns. You will want to look through the
Reconstructed Files results if you are recovering from a hard drive that was accidentally reformatted or had files that
were accidentally deleted.

We do not generally recommend selecting and recovering all of the Found and Reconstructed files simultaneously,
especially from a Deep Scan. It is generally better to spend a little time to select and recover just the files and folders
you want. For example, Deep Scans typically contain huge amounts of operating system-specific files and folders that
will not be useful when recovered, and will just increase the time and space needed for the recovery. You can browse
and/or use the search feature to help locate files you are interested in.

In addition, if you intend to recover many files under Found Files, we recommend that you start by recovering a few
important files first, then verify that the files open properly before recovering the rest of the listed files.

3.4.1 Previewing Files

Data Rescue allows you to preview some file types before recovering the files. This will help determine whether the
files can be recovered properly before being transferred onto another hard drive. On macOS Data Rescue’s preview
uses Quick Look which provides the same type of preview that Finder uses, so major file types such as .doc, .pdf,
.mp3, and .jpg can be previewed through Data Rescue. On Windows only basic images and text can be previewed.

To preview files within Data Rescue:

1. Click on a file’s name within the list to highlight it.

2. Click on the Preview button.

3.4.2 Searching the Scan Results

The search feature will allow you to quickly filter your results and find your most important files. Search can be used to
quickly filter the results for specific filenames or extensions. Files can be filtered by file name, extension, size, and date
modified. The scan results will be updated with any files that match the extension or word within the filename. Please
note the Search feature does NOT look within the contents of the files for keywords.

To use Search:

1. Click on Search.

2. Choose a condition to search for, by default Name is selected. Click the + or - buttons to add more

conditions to search for Extension, Size, or Date Modified.

3. Click the Search button. Allow adequate time for the results to filter and update the list.

After viewing the Search results, you may return to the complete scan results by clicking on the Back button. Any files
marked for recovery in the Search results will remain marked for recovery when returning to the scan results.

Installing and Starting Data Rescue Create Recovery Drive

3.4.3 Recovering Files

While previewing the files, you may begin marking any files to recover. You may choose to recover each file
individually or in groups by marking multiple files and pressing the Recover button. After completing a scan and before
recovering a large number of files, it is highly recommended to first try and recover only a few of your important files to
make sure they contain good data. There are some situations where there can be uncertainty about the proper
Allocation Block Layout choice section (for more information see the Allocation Block Layouts section).

Specific files can be marked for recovery by using the checkboxes within the scan results. This allows you to choose
multiple files throughout the scan results to be recovered as one process. If you would like to recover all the possible
results from your hard drive, you can mark the root selections Found Files and Reconstructed Files, however it is
generally best to select specific files and folders you want to recover to save time and hard drive space.

To recover files using the checkboxes:

1. Click on the checkboxes to mark any files you are interested in recovering.

2. Click on the Recover button.

3. Select the destination for your files to be transferred to and click on Open. Allow adequate time for the

files to be transferred onto the destination.

Table of Contents

Using Data Rescue Tasks

Using Data Rescue Tasks

Table of Contents

4 Create Recovery Drive

Create Recovery Drive is a feature for macOS that allows Data Rescue to create a bootable disk to safely recover files
from your main drive (also known as your startup disk).

Before starting, you must have:

A drive that is 8 GB in size or greater. USB is preferred.

Warning: the drive selected will be erased!

To create a recovery drive:

1. Select Create Recovery Drive from the Welcome page

2. Select a drive to use

3. Choose Start and confirm the operation.

After the drive has been created, you may now boot into that drive to begin using Data Rescue using the instructions
below:

To boot from the recovery drive :

1. Insert the recovery drive

2. Turn on, or restart the computer.

3. Immediately press and hold the Option key.

4. Select “Data Rescue” when it appears.

Table of Contents

Create Recovery Drive Manage Custom File Modules Table of Contents

5 Tasks

5.1 Quick Scan

Select the Quick Scan if:

A drive’s operating system fails to boot.

An external drive fails to mount.

The Quick Scan is the fastest method that detects existing directory structures even if your volume does not mount.
This scan will detect files with their original folder hierarchies and file names. It is recommended to try this scan method
first if your volume is detected on the hard drive.

A Quick Scan can only be used on a volume. If you have selected the hard drive to be scanned, the Quick Scan will
attempt to search for the first available volume on the hard drive, then rebuild the directory structure for that volume.

The Quick Scan typically takes a few minutes to complete, but may take up to a few hours to retrieve the results in
more severe cases. Bad blocks on the hard drive may slow down the scan process, but will immediately speed up
once it has overcome those bad blocks.

5.2 Deep Scan

Select the Deep Scan if:

No volumes are detected on the hard drive.

A hard drive was reformatted.

The Quick Scan did not provide expected results.

The Deep Scan is a comprehensive scan method that provides the most results possible. The Deep Scan is a two part
scan method: 1) detects existing directory structures on the hard drive, 2) scan the whole hard drive for any file
patterns to rebuild the raw data of any recognized files.

As the first part of the scan, Deep Scan will detect any existing directory structures like the Quick Scan, but can detect
multiple directory structures while scanning hard drive with more than one volume. This will provide you with results
from each found volume, with their original directory structures and file names.

The second part of the Deep Scan searches the entire hard drive for any files based on file patterns. Data Rescue
detects over 150 major file types based on the files’ raw data. These found files will not have their original directory
structure or filenames since Data Rescue is rebuilding the files based on their file design. Instead, these results will be
provided with generic filenames and organized by category in the Reconstructed Files folder.

The Deep Scan usually takes up to three minutes per gigabyte. With large capacity hard drives, it may require several
hours to complete a scan. Physical issues such as bad blocks on the hard drive may slow down the scan process even
longer, but the scan will immediately speed up once it has overcome the bad blocks. Allow adequate time for the scan
to finish.

5.3 Clone

Select the Clone feature if:

The hard drive appears to be having some hardware problems

Quick or Deep Scans are stating an excessive amount of time to scan

You need an identical copy of the hard drive

The purpose of the Data Rescue cloning function is to copy a drive or volume to another drive or volume, so that the
copy may be scanned, reducing the wear-and-tear on the original hard drive. This will free the hard drive from use
while preserving the data that was on it for later scanning. Cloning is normally not required in order to scan and recover
files with Data Rescue. The goal is to transfer all the data from the source to the destination, making a perfect one-to­one copy where it is possible. In some cases, due to disk errors on the source, copying can be hindered to the point
where getting a perfect 100% is not possible because of the huge slowdown in read rate caused by errors; then the
goal becomes transferring as much of the source data to the destination as possible within a certain time period.

To use the Clone feature, a spare hard drive is needed with the same or larger capacity than the original hard drive.
The Clone feature makes a single pass copy of your hard drive onto another hard drive or into a disk image. Please
note the cloned hard drive will be in the same logical state as the original hard drive. This means if the original hard
drive is failing to mount or boot, the cloned hard drive will have the same failure to mount or boot. The purpose of the
clone is to help overcome any slow reads or possible hardware failures that exist on the original hard drive.

Create Recovery Drive Manage Custom File Modules

If the original hard drive appears to have hardware problems, it is highly recommended to clone the hard drive first to
reduce the use of the source drive while it is still operating. Once the original hard drive is cloned, you may put the
original hard drive away for safekeeping and perform the recovery options on the cloned hard drive.

To Clone a hard drive:

1. Select the device level of the hard drive in Step 1.

2. Select the Clone task in Step 2.

3. Select the Clone Target where the hard drive will be cloned to and click on Start Clone. Wait for the

clone process to complete.

Cloning the device level will copy the entire hard drive’s partition map onto the other hard drive. If there are multiple
partitions on the hard drive, the partitions will be cloned onto the destination as well. You may select and clone
volumes rather than the whole hard drive; however, this is only recommended if you are instructed by Prosoft technical
support or you have knowledge and experience about disk partitions and volumes.

Warning: The Clone process will overwrite the contents of the Clone Target. Ensure you have a backup
of the contents of the Clone Target hard drive, or use an empty hard drive. Be extremely careful to
choose the target so that you don’t write to the wrong drive or volume.

To Clone to a disk image:

1. Select the device level of the hard drive in Step 1.

2. Select the Clone task in Step 2 and click on Continue.

3. Select New Disk Image as the Clone Target.

4. A prompt will appear to title the saved disk image. Give a title to the disk image and select the

destination for the disk image file and click Save.

5. Click on Start Clone. Allow adequate time for the clone process to complete.

Cloning to a disk image will allow you to save the entire contents of a hard drive into a single file. This is a good option
if you have available hard drive space, but do not want to erase the contents of another hard drive. The disk image can
be opened later to help simulate the original hard drive and complete a scan for recovering files.

The Strategy setting is for advanced users who have special needs with regards to cloning. The default cloning
strategy should be adequate for almost all users and situations:

Straight: This straightforward strategy starts at the beginning of the source media, and sequentially copies buffers of
information to the destination media, one at a time, working straight through from start to end. If read errors are
encountered, the algorithm just keeps going through them sequentially. If the disk should happen to have an area of
errors close to the start of the hard drive, this means the algorithm may spend many hours trying to work through this
area, without having copied much data.

Reverse: This strategy is nearly the same as the straight copy, except that instead of working from the start of the
media to the end, it works from the end of the media to the start. In the aforementioned case where there were errors
at the beginning of the media, this strategy can help by allowing most of the data to be cloned before running into the
problem area.

Bisect: This strategy is influenced by the detection of errors found during the clone process. The clone will start at the
beginning and clone until an error is encountered. Once an error is detected, the remaining space to clone is divided in
half, then the clone process will continue from the second half of the remaining space. After the second half is cloned,
the clone will return to the first half of the space to finish cloning. This process will repeat as more errors are detected
on the hard drive.

Segment: This is the default cloning strategy that is similar to bisect copy, but provides a more elaborate and efficient
method to clone the media. The space of the hard drive is divided into 64 pieces, which are further subdivided if errors
occur to ensure a clone of the healthy blocks of data while ignoring any bad blocks. If there are no errors, it will proceed
exactly like the straight copy from the start to the end.

Most users should just use the default segment copy. The Reverse Copy method can be useful if the user knows that
most of the errors are near the start of the media.

Table of Contents

Tasks Preferences Table of Contents

6 Manage Custom File Modules

Manage Custom File Modules is accessible under the View menu. This feature allows training Data Rescue with

knowledge about additional file types that it yet doesn’t know about. It’s split into two modes: FileIQ and Manual.
FileIQ requires input of good working sample files for a specific file type. From these samples it will try to find a pattern
that corresponds to all files. FileIQ will work for many, but not all types of files. However, Data Rescue will tell you if
your sample files are likely to work or not, and there is nothing to lose by trying. Manual mode allows entering this
pattern in directly, to get more accurate information. Please note that Manual mode requires activating a Professional
license to complete.

Select the Manage Custom File Modules feature if:

A file type you are searching for is not found

You have a special file type that is not supported by Data Rescue

You want to check if a file type is supported

To add a new file type into Data Rescue:

1. Click on FileIQ.

2. Click on Choose Files to add file samples.

3. Choose any at least three files of the same file type.

4. Click on Open to add the files into the list.

5. Click on Add.

To utilize FileIQ, Data Rescue needs to analyze good working files of the same file type that is missing. These may be
older files that you have previously created with your program. You will usually need to reference at least three files of
the same filetype to properly create a file module; however in some cases, as few as two files may work. In general,
the more file samples provided into FileIQ, the more accurate the created file module will be. If you do not have sample
files available, you may consider creating some files of the same file type with the program used to make the files.
However, ensure these files are not saved to the hard drive missing the data.

6.1 FileIQ Advanced Options

Show advanced options displays some additional parameters that you may use to further define the file module.

The Details tab includes some fields to describe the file type, how the file names will be generated, and which folder
they will appear in. Data Rescue will automatically fill in most of the fields when sample files are listed in FileIQ. Data
Rescue will fill in the Template File name, Extension, Folder Name, and Max File Size based on the sample files’ data.
The fields will define the following attributes for the file module:

Template File Name is the generic name that will be provided to any found files.

Template Extension is the file type determined by the file samples.

Folder Name is the location where the found files will be displayed in the scan results list.

Max File Size limits the size of the data captured for the file. Ideally this should be large enough that you are

sure all files of this type are smaller than this limit. If in doubt, you may make this value larger because files

larger than this number will either not be found or will be truncated when recovered. If you do not specify a

value for Max File Size, Data Rescue will choose a value that is about 10 times larger than the largest file

sample you added.

The Pattern section allows you to modify the matching algorithm. The Matching drop down menu instructs Data
Rescue how selective to be in matching start patterns for the file type. The default selection for Normal will give a
basic comparison of the bits to determine the file pattern. If your scan returns too many files that are not similar to the
filetype, you may change the Matching selection to Tight. This will make Data Rescue compare more bits in the file
pattern to potentially detect the files more accurately and reduce the amount of results provided. If your scan returns
too few files, you may change the Matching selection to Loose to compare less bits in the file pattern and provide more
scan results.

If Data Rescue determines that the sample files have a usable and consistent end pattern, it will use enable the Use
End Pattern option. Using an end pattern should result in recovered files that have the correct length, instead of
potentially adding incorrect data. However, enabling the Use End Pattern option may reduce the scan performance
considerably and may take longer to complete the scan. If you uncheck the Use End Pattern option, the end pattern
will not be used for the scan.

Tasks Preferences

Data Rescue currently does not support editing previously saved definitions. To change the Matching selection, you
will have to recreate the FileIQ definition and save the different matching selected.

Once you click Save, new file types will immediately be installed in Data Rescue to allow you to search for their
respective files.

6.2 FileIQ Troubleshooting

After adding the sample files, you may be provided with a few different outcomes. This section discusses some cases
that may occur while trying to generate a file module.

The file samples may be recoverable by an existing module. If a file module is listed in the “Recoverable by Existing
Module” column, then it may not be necessary to create a file module. This means the file samples you have provided
are similar to another file module that Data Rescue already detects. The results you are provided by a scan may
already detect your files, but you may need to rename the extension to open the files properly by your program. As an
alternative, you may choose to save the file module to replace the existing module and a new scan of the hard drive
will detect your files properly. A common example of this are certain camera RAW images that are sometimes found as
TIFF images instead.

FileIQ may not detect a suitable starting pattern for the sample files. If different programs create the same kind of file,
it’s possible the files with the same extension may not have the same starting pattern, and therefore won’t produce a
usable result. For example, Quark and FreeHand programs both create EPS files, and if you took samples from both
programs to create a file module, FileIQ may report an issue because the programs create different formats for the
files. You may consider replacing some of the sample files with other files of the same type. For best results, use file
samples that are created from the same program, and preferably the program that produced the files you are looking
for.

There are cases in which FileIQ cannot create a file module. Some reasons a file module may not be created include:

The files are packaged file types. (macOS only) These are files that appear as a single file, but are actually

folders with more data inside them. Since packaged files are made of multiple files, there is no method to

reconstruct the file as a whole. Common examples of packaged files are application bundles.

Inconsistent file patterns. These are files that do not have common file patterns that can be detected between

the files due to different internal formats or raw data throughout the file. An example of this may include

database files.

Repetitive file patterns. These are files that have a common file pattern that repeats multiple times throughout

the file that a correct end of file cannot be determined. An example of this is a video file that has the same file

pattern repeating every frame. This may result in a large number of single frame video files, but not a complete

video.

Table of Contents

Manage Custom File Modules Professional Mode Table of Contents

7 Preferences

The Preferences menu is available under the menu bar at the top of the screen.

7.1 General

Automatically check for updates will detect whether there are any new versions of the software available for

download when the software starts.

Share usage information with Prosoft will submit information about how Data Rescue is used so Prosoft can
optimize the user experience of the software.

7.2 Preview

The Preview preferences include settings for Data Rescue’s preview feature when viewing scan results.

Maximum auto-preview file size allows you to set the maximum size of a file that will be previewed automatically. By
default it is 10MB, so any file greater than this will not generate a preview until one is manually requested.

Render previews with Quick Look is a macOS-only feature that displays previews using the Quick Look engine built­in to macOS. This is default turned on. When disabled, Data Rescue’s basic built-in preview will be used instead. This
preview is what is used on Windows.

7.3 Notifications

The Notifications preferences controls options for receiving email notifications when a scan or recover is finished. Enter
an email address that would be used to receive the notifications, then check Scan Finished and/or Recover Finished
for the events to trigger the notifications. Optionally, check the Use local IP address in subject instead of machine
name field to modify the subject of the email to include the computer’s IP address instead of its name. This may be
useful for data recovery technicians with multiple recovery workstations. Finally, make sure the email address entered
is correct by clicking the Send Test Email button. In a few minutes you should receive an email confirming the test. If
you do not see the email please check your spam or junk folders.

7.4 Scan Engine

The Scan Engine preferences are additional settings for adjusting Data Rescue’s scan processes. Although there are
many additional settings available, the default values should be fine for most situations and users, so changing these
settings should not be necessary. The Scan Engine preferences are available to provide extra flexibility for expert users
and in unusual circumstances where the default settings are not providing substantial results.

The Scan Engine preferences are organized hierarchically and displayed as a tree. Highlighting a portion of the tree in
the left-hand window will cause any associated properties and values to appear in the right-hand window. If you
highlight a property, a description is displayed in the small text window in the lower-right corner of the window.
Properties with boolean (on/off) values are represented with a checkbox. Properties with numerical or text values are
shown with a text field that can change the value. If a property is not editable, it will be shown in a gray font (dimmed).
To edit a numerical or text value, double-click the current value, then type in the new value.

For properties which represent file sizes, you can input a new value using KB, MB, or GB size shortcuts. For example,
to specify a size of 2 kilobytes, you can input either “2048” or “2KB”.

The most common need to access the Scan Engine preferences is to increase the maximum file size for a certain file
type when you expect to find very large files of this type. For example, the default maximum size for most movie file
types is 10GB. If you are looking for 25GB QuickTime movies, you will need to go into the preferences and increase
the maximum file size to something larger than the biggest file you are looking for.

Reset Scan Engine Preferences will changes all the Scan Engine Preferences back to default settings. This is useful
if you have previously changed any of the Scan Engine Preferences and would like to run based on the default
configurations.

The various scan engine preferences are discussed in the following sections.

7.4.1 File Modules

The reconstructed files that are found by Deep Scan are based on individual file modules. Each file module is
responsible for detecting one kind of file. Most file modules have a number of preference properties in common, such
as enable, maximum file size, etc. The file modules are grouped by category based on the file type. For convenience,
some of the properties for the individual file modules may be specified at the category level of the tree, which will allow
all the file modules of the same category to use the same values. Individual file modules may still override the values
from the category values.

7.4.1.1 Top Level File Modules Preferences

Enabled specifies whether a module is enabled to look for files during a scan. The default enabled value for this node

is On. All the file modules underneath this point of the tree will be enabled, unless overridden at a lower level.

Number of filename digits controls how many numerical digits are used when generating names for files found by the
file modules. For example, with the default setting of 5, the filenames will be generated as abc-00001, abc-00002, etc.
Changing this setting to a value of 3 will generate file names as abc-001, abc-002, etc. The purpose of the leading
zeros is so the Finder will list these in numerical order. Setting this value to 0 will have no leading zeroes added to the
file name.

Maximum file size controls the maximum size that certain files can be. If a found file exceeds this value, the file will be
ignored. Not all file modules implement a maximum file size.

7.4.1.2 Category Level Preferences

The category level preferences consist of the categories of file modules, such as Mail, Documents, Audio, etc. These
categories are organized the same as the reconstructed file results. The preferences that are inherited from the top­level file modules preferences are still shown so you can see their values, but are not editable (dimmed).

A few categories have their own properties. For example, the Text category is disabled by default because its severe
impact on performance and results. However, you may choose to enable the Text category if you want to scan for a
particularly important text document that is not recovered by any other file module.

Other examples of unique preferences include Maximum consec bad chars for Text file modules to help detect the
end of a file properly and Minimum image dimensions for Video and Images.

7.4.1.3 File Module Preferences

The lowest subcategory displays preferences for the individual file modules. The properties which are listed in green
are preferences which are using a value from a higher place in the tree.

7.5 Recovery Preferences

Change ownership will change the file and folder ownership for all recovered files to the user running Data Rescue.

This is helpful if the original hard drive was experiencing file ownership problems.

Permissions promotion will change permissions of any recovered files to “Read and Write” based on the selected
preference.

None will not change any permissions on any recovered files.

For items with no access will change permissions only for any files set as “No Access”.

For all items will change permissions of any recovered files.

7.6 Scanning Preferences

Maximum files/folders preference is used during scanning when Data Rescue has to create its own folders using

catalog files, such as the Orphans Folder within the Found Files results. When the number of files would exceed the
value set in this preference, Data Rescue will create a new folder. The default is 1000 files per folder.

7.7 Drive Failure Detection

Data Rescue can detect when a drive may be failing by analyzing the time it takes to read from the drive. If at any time
it detects this, the Drive Failure Warning window will appear.

At this point Data Rescue has detected slow read access on one or more of your drives, which may be a sign of a
failing drive. If this persists, you have a few options:

1. Stop the current task (scan, recovery, etc.) and perform a Clone. Cloning allows you to copy your drive to good

drive. Data Rescue can then scan and recover off the good drive safely.

2. Disconnect the drive from your computer, turn off its power (if applicable), and contact a data recovery

company.

3. Let the current task continue until completion (not recommended).

Warning: Attempts to run a scan on your drive (if it is failing) for an extended period of time (e.g. days)
may cause the drive to completely fail. This could prevent any data recovery company from being able
to recover your data entirely.

Manage Custom File Modules Professional Mode

Selecting a drive and clicking Ignore will cause Data Rescue to ignore all further warnings on that drive until the
application is relaunched.

Selecting Details will provide a list of the sector (block) offsets and the time it took for Data Rescue to read from that
sector. This is more useful for expert users such as data recovery technicians.

For further assistance with a possibly failing drive, please see the Drives With Suspected Hardware Problems section.

Table of Contents

Preferences Frequently Asked Questions Table of Contents

8 Professional Mode

The Professional mode is designed for technicians or experienced computer users to help recover data in more
complex recovery scenarios. To enable Professional mode, go to View > Switch to Professional Mode. While in
Professional mode you can use the full user interface, however to recover in this mode you need to purchase and
activate a Professional License.

8.1 View Hex

View Drive Hex, View File Hex, and View > Open File in Hex Viewer provide a read-only hex viewer for displaying raw
drive and file data. The Hex Viewer provides several features:

Go to Offset: quickly jump to a specific offset by byte or sector value.

Find: locate raw hex values or text in ASCII, UTF8 and UTF16. Find Prev and Find Next allow jumping between
results. Clear Find will clear the current find results.

8.1.1 Template

The Template drop-down lists binary templates for viewing raw data in a human-readable format. Templates are
written using the Lua scripting language. Data Rescue provides some built-in scripts, but custom scripts can be loaded
from the application data directory. On macOS this is ~/Library/Application Support/Prosoft

Engineering, Inc./Data Rescue/Templates/ and on Windows this is %APPDATA%\Prosoft
Engineering, Inc.\Data Rescue\Templates\. When making changes to files in this directory, click the refresh

arrow icon in the Hex Viewer window to reload the drop-down.

As an example here is the source for Data Rescue’s “Master Boot Record” template:

template("Master Boot Record")
endian("little")
hex("Bootstrap Code", 446)
for i=1,4 do
beginSection("Partition " .. i)
hex("Status")
uint8("Start Head")
hex("Start Cylinder", 2)
uint8("Partition Type")
uint8("End Head")
hex("End Cylinder", 2)
uint32("First Sector LBA")
uint32("Num Sectors")
endSection()
end
hex("Signature", 2)

Each template must begin with the “template” function which gets passed the template’s name. A “endian” function can
be used to set “little” or “big” endian.

The supported functions for data types are listed below:

char

hex

fourcc

uint8

uint16

uint32

uint64

int8

int16

int32

int64

macdatetime

utf16

Lastly, “beginSection” and “endSection” functions can be used to create groups, as shown in the example above. Pass
the section name to “beginSection”.

8.2 Set Drive Parameters

Set Drive Parameters is a feature that allows you to specify a starting and ending location for scanning. Using this

feature manually sets parameters for the selected media. This is helpful if a hard drive’s partition table was erased or
damaged, but the file system and block size are known to simulate the original partition. Manually setting the drive
parameters requires technical knowledge of the media’s original settings to effectively utilize this feature.

Start Sector is the new starting sector offset which specifies the start point of the media where Data Rescue

will begin its process.

End Sector is the new ending sector offset.

The Reset button will reset the values to the default information based on the media’s original settings.

Once the parameters have been set, you may proceed with the standard steps to scan your hard drive.

8.3 Scan Management

The Professional mode in Data Rescue allows for advanced management of scan data. In Standard mode, only one
scan result is stored at a time. In Professional mode, up to 15 scan results can be stored. By keeping previous scan
results, Data Rescue allows you to return to the earlier scan results to recover additional files. The Scan table at the
top right of the window lists each available scan. Here you can Delete, Export, or Import scans, along with Assign
Drive which modifies the scan’s associated drive. While the Delete action has its own button, the other actions require
a right-click on the scan table to bring up the contextual menu.

8.3.1 Export Scan

Exporting a scan allows a user to save the results of a scan into a .drscan file to be reloaded at another time. This
feature is primarily useful to archive scan results for access at a later time, or on the same computer setup, without
taking up space in the meantime. It could also be used when a scan needs to be continued on another machine. For
example, consider that an external hard drive has failed and a scan was started on a computer, but the user decided
they needed that computer for another purpose. The user may save the the scan file onto a separate device (such as a
USB flash drive), connect the external hard drive to a different computer, and import their scan with Data Rescue from
that machine.

8.3.2 Import Scan

As described in the previous section, a scan can be imported from a .drscan file. The imported scan will be listed within
the Scan table. Once imported, you may select the scan to view the scan results.

8.3.3 Delete Scan

Data Rescue archives all scans that it has completed. These scans may take up several hundred megabytes to
gigabytes of space. After a scan is complete and the data has been recovered from the drive in question, you may
delete the previous scan from Data Rescue to reclaim the space on the hard drive. Deleting the scan is recommended
only when the recovery process is completed. Once the scan results are deleted, the scan will need to be started from
the beginning once again if further results were needed.

8.3.4 Assign Drive

Assign Drive allows you to reselect the source drive for any previous scan results in case the original drive was

renamed or detected incorrectly. Assign Drive is necessary because Data Rescue attempts to assign a drive to a scan
automatically, but due to various factors with the drive it can’t always reassign correctly. Another common use is if a
drive is scanned, then the drive’s data is cloned to a larger drive in order to reuse the original scanned drive, and the
user wants to reuse the existing scan with the new cloned drive.

Selecting this feature will provide you with a list of connected drives to reference as the source. Once the correct media
is selected, you may continue with your recovery process from the results.

8.4 Add Virtual RAID

Add Virtual RAID allows you to simulate a physical RAID configuration. This is helpful in case a RAID configuration

fails to mount or be recognized as a single volume. Please note that Add Virtual RAID does not attempt to fix or repair
a RAID set. Instead, the RAID set is configured through Data Rescue for the purpose of scanning for data. Add Virtual
RAID will not write any data to the hard drive, keeping the original state of the hard drives. This feature is specifically
intended to help simulate RAID configurations.

When the window opens, the Available Drives list shows all drives that Data Rescue can access. Select one or more
drives and click Add to append them to the RAID Members list. Once a drive is added to the list it can be removed via
the Remove button, or its position altered via the Move Up and Move Down buttons.

The Configuration section allows for choosing the RAID Type and Stripe Size (if applicable). Data Rescue supports
two basic types of RAID, described very briefly below:

RAID 0 - As data is read sequentially from the RAID set, it comes first from the first component drive until a

stripe-sized amount has been read, then the next data comes from the second component drive, and so on, in

round-robin fashion.

JBOD - This is not an official RAID level, but rather a way to make multiple hard drives appear as one big drive

by concatenating them together. As data is read sequentially from the RAID set, it comes first from the first

component drive, until the end of that drive is reached, then continues coming from the second component drive,

and so on until the end of the last component drive.

New in Data Rescue 5 is the Auto-Detect button which will enumerate through each supported RAID type and
common stripe sizes (if applicable) and performs a quick scan with each configuration. If files are discovered through
the scan, then that configuration state is saved. When completed, a list of states discovered will be presented and a
result can be chosen.

Once the RAID set has been added, it can be selected to scan for data. In some cases, data may not be opened
properly when recovered if the drives are not arranged in the correct order.

8.5 Recover Options

In Professional mode the Recover button provides advanced functionality beyond what Standard mode provides:

Destination folder is the location where files will be recovered to. Make sure to pick a folder that is not on the

source drive you just scanned.

Merge files into existing folder : when enabled, any files saved are merged into a previous recovery folder if it

exists. Otherwise a new recovery folder is created. This option is helpful to reduce recovering duplicate data that

may have already been recovered.

Existing file behavior determines how Data Rescue recovers a file if it determines the file has already been

recovered

Recover with New Name: a new unique file name is generated and used instead. This is default.

Overwrite: the file will be overwritten.

Skip: the file will not be recovered, only if the file sizes match.

8.6 Secure Erase Tool

The Secure Erase tool, accessible from the View menu while in Professional Mode, allows you to easily erase the
selected drive. The tool will overwrite each sector with the given pattern, or a random pattern. Patterns can be entered
as a hex value or numbers and letters. For example, “\xAB” is the equivalent to 0xAB hexadecimal. Secure Erase does
not format the drive with a file system, this must be performed using the operating system’s drive utility. Please note
that the entire drive is overwritten and all existing volumes will be lost.

8.7 Number Sectors Tool

The Number Sectors tool is a simple tool that assists with guessing the order of drives in RAID-like devices. Each
sector of the drive that is seen by the operating system will have its sector data be the number for that sector. For
example, sector will be “0” in ASCII followed by 511 NUL bytes. Same with “1” for sector 1, etc. Once written (or
enough to satisfy a limit), the device can be disconnected from the computer and each individual drive member can be
examined to determine where the number sequences start and stop. Please note that this tool, like Secure Erase, will
permanently overwrite sectors that it touches and data loss can occur.

8.8 Allocation Blocks Layout

Allocation Blocks Layout can be used after a Deep scan if the files listed by the Found Files results are not opening

properly after recovery. If none of the files open when they are first recovered, selecting this feature will provide you
with additional options which may correct the way the files are found.

During its scan, Data Rescue determines some possibilities for the proper Allocation Block Layout setup. The Block
Size is the number of bytes of the allocation block. The Offset is the number of bytes (represented in hexadecimal),
from the start of the media to the start of the file system.

The first choice is the default selection that Data Rescue considered to provide the best results, but if the files are not
recovered properly, try each of the other selections.

To find the best allocation block layout for recovering files:

Preferences Frequently Asked Questions

1. Complete a Deep scan on the hard drive.

2. At the results window, select a basic file (such as a JPEG image or text document) from the Found Files

folder.

3. Click on Preview to view the file.

4. If the file preview does not properly show the file, go to the Expert menu and click on Allocation Block

Layout.

5. Click on the next available selection inside the Allocation Block Layout window.

6. Click on the results window.

7. Select the same file and click on Preview to view the file. If the file opens correctly, try previewing a few

other files to ensure they are viewed properly also. If multiple files begin opening correctly, this is a good

indication the right Allocation Block Layout was selected. The files can be selected and recovered at this

point.

8. If the files do not open in the Preview window, repeat steps 5 through 7 until the file is opened properly

in Preview.

In some cases, such as a drive you scanned had more than one partition or if there are remnants of older file systems
still present on the disk, you will find that some files require one Allocation Block Layout selection and other files will
require a different selection.

8.8.1 Canceling a Scan

In Professional mode scans can be cancelled just like Standard mode. However, an additional End Early option is
present for Deep Scans. Selecting the End Early option will force Data Rescue to end its current scan and provide
results up to that point of the scan. This is a helpful option if you are having difficulties scanning a drive due to bad
blocks or slow reads. Please note that ending the scan early will end only the first phase of Data Rescue’s scan
process, and will still progress through the next two phases of the scan process to catalog the results. Allow adequate
time for the results to be processed.

Table of Contents

Professional Mode Glossary Table of Contents

9 Frequently Asked Questions

The following chapter contains some commonly asked troubleshooting questions and their solutions or workarounds. If
problems still persist, contact Prosoft Engineering technical support.

Data Rescue seems to freeze. What should I do?

Most cases of apparent freezing are actually slow reads due to disk problems. If Data Rescue runs into a disk area
where the disk is having trouble reading, it may appear to freeze, but actually just be very slow. If you think it has
frozen, make a note of what is being displayed on the progress display, for example, the block number, then check
again in half an hour or so and see if it has advanced at all. If it progresses, it is probably just slow due to disk read
problems. If you continue having difficulties, make sure cables connecting to the disk drives are properly seated and
consider disconnecting or turning off any unnecessary devices connected to the computer.

Why doesn’t my drive or volume show up?

If you have attached a drive with a damaged volume since you started Data Rescue, Data Rescue may not
automatically notice it. Try the File > Refresh Drives List menu item. If the volume you are looking for still does not
appear, it may be because Data Rescue is unable to find the correct name for it, in which case it may show some other
name such as “unknown” for the volume name. Or it may be that Data Rescue can see the device, but is not able to
recognize a volume structure on the device. If that is the case, you will need to choose the device name for scanning
rather than the volume.

Finally, it could be possible that your drive is malfunctioning to the point where your computer is not able to talk to it at
all, in which case even the device name will not appear. In this case, Data Rescue will not be able to scan your device.
In this latter case, you might try some or all of the following things to see if your device can be made to appear: Double­check the drive cables and power source; remove/reattach the drive and/or power cycle it; power down and restart your
computer. You can also double check that the problem isn’t with the Data Rescue software itself by looking for your
volume/drive using Disk Utility (on macOS) or Disk Management (on Windows). If these tools can see it, Data Rescue
should be able to also; if not, then Data Rescue won’t be able to either.

Why are some files listed twice?

Sometimes, your volume contains obsolete catalog entries. If Data Rescue finds two catalog entries with identical
names, it first checks if the two entries refer to the same data. If so, then the items are called “true duplicates”, and only
one of these will be retained, and the other automatically removed. If the two entries refer to different data, both of them
are retained, even if they have identical names and appear to be in the same directory, because there is no way to
know which one is the correct one. To find which is the correct entry, check dates and file contents.

Why do my found files total more than the size of the original drive?

There could be a few reasons for this, as explained below.

When you do a Deep Scan, Data Rescue uses two different algorithms to locate files. These methods will often locate
many of the same files twice - once under the Found Files folder and again under the Reconstructed Files folder. Data
Rescue will do its best to prune files in the Reconstructed Folder that correspond to files in Found Files, but it may not
always filter out all files. So if you elect to recover everything, it will often be the case that the total space required
exceeds the original media size.

The second reason why the found files may total more than expected is the possibility of anomalously (and incorrectly)
large files. In the course of scanning the media, Data Rescue will often come across bad files and catalog entries. Data
Rescue is able to filter out the vast majority of these bad entries, but not all of them. Occasionally a few of these may
show up in the recovery list with incorrect and large sizes. If you suspect this may be the case, you can easily find
these large files by searching for files greater than a certain size. A useful technique to eliminate these from the
recovery is: first mark everything by clicking the checkbox for the top level folders, then search for and uncheck the
large files which appear to be bogus.

Why is there a delay when I click the mark checkboxes?

After scanning a large drive, there may be hundreds of thousands or millions of files and folders to deal with. When you
click on a mark checkbox in the recovery list to mark or unmark files for recovery, especially the top-level folders, Data
Rescue has to walk recursively down through most of these items to individually mark or unmark them. The time this
takes is proportional to the number of found files.

Does Data Rescue handle RAID volumes?

With RAID, several component drives are set up to act logically as if they were a single composite drive. If your RAID
drives or file system is in good enough shape that the system can still make them appear as a single logical drive, then
Data Rescue should be able to scan that composite drive and recover files from it.

Professional Mode Glossary

If the situation is such that the system cannot present the component drives as a single composite drive, then the
answer depends on what kind of RAID your drives are set up to do. If the drives are set up to do mirroring (i.e. each file
is stored completely on each mirror drive), then Data Rescue should be able to do a Deep Scan on any of these
component drives and recover files.

If the RAID is configured as a RAID 0 or JBOD and you have purchased a Professional license, you may switch to
Professional mode and use the Add Virtual RAID feature to help simulate and scan the RAID. If the composite RAID
device is visible without adding a virtual RAID, it is almost always better to scan that than to create a virtual RAID and
scan it.

I recovered files, but they won’t open. What’s wrong?

The answer to this question depends on whether you’re talking about files recovered from under the Reconstructed
Files or Found Files Folder.

Files recovered by catalog (i.e. from the Found Files folder) It’s normal for a small percentage of recovered catalog
files to be bad. But if you have checked a number of them and none of them are good, then chances are that they were
recovered with the wrong Allocation Block Layout setting. Pick out a few files to use as test files, and go back and
select a different Allocation Block Layout choice and recover a few files. If you find an ABL setting that gives good
results on those files, re-do your big recovery with that setting.

Files recovered by content (i.e. from the Reconstructed Files folder) It’s also normal for a small percentage of
these files to be bad. If the original file was fragmented (not stored on disk in consecutive blocks), then it can not be
properly recovered by content. In most normal situations, most files on a user’s disk will not be fragmented. Typical
fragmentation rates for files tend to be just a few percent. Note: The ABL setting plays no role in recovering files under
the Reconstructed Files folder.

Can I recover files that I deleted accidentally?

When a file is deleted on macOS and Windows using the HFS+ and NTFS file systems, the file’s name and folder
information is usually erased by the system, and is therefore irretrievably lost. However in most cases, the most
important part of the file - its contents - are still present on the disk. Finding the file by its contents alone is in general a
difficult task, requiring algorithms to recognize those contents among all the billions of bytes of data on the disk. The
Deep Scan will list over 150 major file types it detects based on its file patterns.

What are Data Rescue’s general content scan capabilities?

In generic technical terms, Data Rescue’s content scan is potentially suitable for any normal data file.

On macOS some files are in reality a collection of separate files which are treated like a single file, called a bundle. The
individual components of a bundle may be recoverable by content scan, but again Data Rescue has no automated way
to associate these components back together into a bundle.

An additional requirement for a successful recovery by content is that the file’s data not be fragmented. In other words,
it must be stored from beginning to end in consecutive media locations. Fortunately, most files get stored on disk that
way. The operating system tries to store files in a non-fragmented way when it can. Still it is typical for a small
percentage of files to be fragmented, and these will not recover properly when found by content.

Important: Do not mistakenly use a defragmentation utility (or any other program which will alter your disk) after losing
your files, and prior to scanning with Data Rescue. Doing so will only make it less likely that you will be able recover
your files.

Note: The above limitations apply only to the files found by content. For files that are found by their catalog entries, the
original bundles and forks may be properly recovered, and fragmentation is not an issue.

Specifically what types of files can Data Rescue find by content?

The actual list of file types recoverable by content can be seen from within Data Rescue by going to the Data Rescue
Preferences menu and browsing through the File Modules tree. We expect to be adding to this list on an ongoing
basis. For a recent list of filetypes recoverable by content, see the Release Notes .

For any file types not supported by default, Data Rescue’s FileIQ feature will allow you to analyze sample files and
possibly generate a file module to help detect the files you are looking for.

Table of Contents

Frequently Asked Questions Supported File Types

Frequently Asked Questions Supported File Types

Table of Contents

10 Glossary

Allocation block: this is a block of file data within the file space of a volume. The size of allocation blocks is the same

within a volume, but different volumes can have different allocation block sizes. This size is always a multiple of 512
bytes so allocation blocks boundaries are always aligned with logical blocks.

Creator type: Associated with every file on a Mac is a four letter code that specifies the file’s creator. The creator is
typically the application that created the file to begin with. This code is hidden from the user, but is used by the file
system in a number of ways. For one, along with the File type, it helps determine the icon to display for that file. In
addition, when you double click on a document, it is the application that has the same creator code as the document
that will be launched to open that document.

File type: Associated with every file on a Mac is a four letter code that specifies the type of file it is (e.g. ‘TEXT’
denotes a text file, ‘APPL’ denotes an application). On many other operating systems, the file type is part of the name;
it is usually a three-letter code following a period (e.g. myfile.txt or letter.doc). On the Mac, this code is hidden from the
user but serves the same purpose: to identify the kind of file. It uses the file type, along with the Creator type (see
below) to determine the icon to display for a given file.

HFS, HFS+ : This stands for “Hierarchical File System” and “Hierarchical File System - Plus”. These are the names of
Apple’s proprietary File system layout for Mac OS computers. The newer, HFS+ system affords greater file and disk
capacities, as well as performance improvements over that of the older HFS architecture. HFS+ was released with
Apple’s 8.1 operating system and is designed to supersede HFS. All Mac OS versions from 8.1 Classic through
macOS 10.x support both HFS and HFS+, although since macOS 10.12 Sierra HFS volumes are read-only..

Orphan: An orphaned file or folder is a file or folder which Data Rescue has discovered a catalog entry for, but no
parent catalog folder can be found. Items like this are presented under the Orphans Folder in the Data Rescue scan
results.

Physical block: this is a 512-byte or 4,096-byte block of information on a physical device. Physical blocks start at zero
so physical block #0 is usually the first block of the partition map of a physical device.

Remote volume: A remote volume is a volume that is not directly connected to your computer. Typically a remote
volume is a file server. If your computer is not connected to a computer network (e.g. at your company), you probably
don’t have access to any remote volumes.

Table of Contents

Glossary Release Notes Table of Contents

11 Supported File Types

Data Rescue can support any file type, if it is able to be found in file system structures. Such files will appear under the
“Found Files” folder in the recovery list. For files which have been deleted, Data Rescue supports finding files of a great
many types by their content when doing a Deep Scan. Such files will appear under the “Reconstructed Files” folder in
the recovery list. Below is a list of the file types supported for Reconstructed Files. In addition to these, other file types
not on this list may often be recoverable with FileIQ, using user-supplied sample files to teach Data Rescue about that
type.

Images:

JPEG

TIFF

PNG

GIF

Adobe Illustrator AI

EPS

RAW Camera Formats CRW, CR2, NEF, DCR, ORF, DNG, MOS, SRF, RAF, X3F, MRW

PSD

BMP

PCS

JPEG 2000

Print Shop

MacDraft, MacDraw, MacPaint

PICT

InDesign

PCX

ICNS

ICO

DPX

WFM

Pixelmator

GIMP

Movies:

QuickTime

MPEG-1/MPEG-2/MPEG-4

AVI

WMV

Flash SFW

Final Cut Projects

Raw DV

Cinema 4D

After Effects

MXF

M2TS/MTS

iMovie Project

WebP

Audio:

WAV

MP3

AIFF

AAC/M4A/M4P/M4B

Ogg

Logic LSO

Finale Project

Maya Session

ProTools Session

Reason Session/Refill/Published/Recycle

Digital Speech Standard

Mail:

Eudora

AppleMail

Outlook Express

Entourage database files

Raw EML/EMLX files

Documents:

PDF

Word

PowerPoint

Excel

Quark

iWork ‘05 - ‘09

OpenOffice

Quicken

QuickBooks

AppleWorks/ClarisWorks

FreeHand

AutoCAD

EndNote

FinalDraft

InDesign

VectorWorks

ArchiCAD PLN and LBK

PageMaker

FileMaker

Word Perfect

Celtx Project

Text:

Generic ASCII Text TXT

RTF

XML

HTML

Postscript (non-binary)

Archives:

Retrospect

Gzip

ZIP

RAR

BZip

Stuffit

DMG and Sparse Images

Java archives

XAR

CHM

Miscellaneous:

Resource forks

Property lists (binary and XML). Includes the following subtypes, recovered in various folders and with various

extensions: Comic Life, Master Row, Soft Fill, IBCocoaFramework, ChatRoom, QCPatch, AudioTrack,

CSElement, Web archive, PmProj, Meta Model Key, User Model Key, Axis Limit, Safari bookmarks, and

MyThought files.

Keychain files

OLE files (an older Microsoft Office format, includes generic OLE, Word, PowerPoint, Excel,)

Panorama

SQLite

PEF (a binary executable format)

QuickCeph (disabled by default)

Red One (R3D) files

Pro Tools Session Files

iTunes Music Library

Doom 3 save files

Adobe GoLive

FormZ v4

Cinema 4D

FinalDraft

HyperCard

Finale

Carrera Pro 4

4D Database

iCal

Maya

Quicken

Now Up To Date

Now Contact 3

ProTools

AOL Filing Cabinet

Reunion-8

Phase One TIFF

Lotus Notes Archive

Perl

PHP

TimeCard

Logic Pro

PowerSchool Database

Print Shop

Stickies

Address Book

Virtual PC7

Glossary Release Notes

EndNote

MacTracv6

Reason

AIM Chat

MacInTax

TurboTax

Mozilla Bookmarks/Address Book

StatView

Easy Grade Pro3.6

Cubase

Table of Contents

Supported File Types Table of Contents

12 Release Notes

Version 5.0.2

Improve Create Recovery Drive error handling

Improve NTFS detection

Fix directory structure of multiple FAT partitions

Fix ABL window crash with large number of results

Fix PCIe devices on macOS in Professional mode showing as unknown

Version 5.0.1

Improve validation of recovery destination

Fix several crashes

Fix inconsistent formatting of RAID stripe sizes

Fix NVMe devices on Windows in Professional mode showing as unknown

Version 5.0

New consistent cross-platform user experience for macOS and Windows

New file types:

Images:

DPX

WFM

Pixelmator

GIMP

Videos:

WebP

Archives:

XAR

CHM

File systems supported on all platforms:

HFS/HFS+

NTFS

FAT32/16/12

MFS

Search

Multliple conditions can be combined for advanced searches

File extensions can be searched directly

Preview

Quick Look is used on macOS

Basic file types are previewable in Windows

Email notifications for when a scan or recover completes

Support for recovering hard link files and directories (Time Machine)

Reconstructed Files are cross referenced with Found Files and those with matching starting offsets are removed

“Professional” UI mode:

View by Extension in Expert Mode organizes files by extension

Advanced hex viewer with custom binary templates

RAID auto-detect configuration

Advanced Recover options

File modules can be added manually by using a known pattern

Secure Erase tool which works on multiple drives simultaneously

Supported File Types

Number Sectors tool which helps identify drive order in RAID-like devices

Add basic support for scanning VDI, VMDK, and VHD disk images

Support for MBR disks with more than four partitions

Support for native 4K sector drives

Native 64-bit on Windows

Table of Contents