Prosoft Eng Data Rescue - 3 User's Guide

Data Rescue 3

User's Guide

Doc Rev: 0909-1

Data Rescue 3 Users Guide 1

Licensing and Copyright Information

©2002-2009 Prosoft Engineering, Inc. All rights reserved.
303 Ray St., Pleasanton, CA 94566

This document is protected by copyright. No part of this document may be reproduced in
any form by any means without prior written authorization of Prosoft and its licensors, if
any.

The information described in this document may be protected by one or more U.S.
patents, foreign patents, or pending applications.

TRADEMARKS
Apple®, AppleShare®, AppleTalk®, Macintosh®, iMac®, iBook®, and Mac® are
registered trademarks of Apple Computer, Inc., registered in the U.S. and other countries.
Iomega®, Zip®, and Jaz® are registered trademarks of Iomega Corporation, Inc.,
registered in the U.S. and other countries.

Word®, Excel®, and PowerPoint® are registered trademarks of Microsoft Corporation,
Inc.

All product names mentioned herein are the trademarks of their respective owners.
THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY
KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, OR NON-INFRINGEMENT.
THIS DOCUMENT COULD INCLUDE TECHNICAL INACCURACIES OR
TYPOGRAPHICAL ERRORS. CHANGES ARE PERIODICALLY ADDED TO THE
INFORMATION HEREIN; THESE CHANGES WILL BE INCORPORATED IN NEW
EDITIONS OF THE DOCUMENT. PROSOFT ENGINEERING, INC. MAY MAKE
IMPROVEMENTS AND/OR CHANGES IN THE PRODUCT(S) AND/OR THE
PROGRAM(S) DESCRIBED IN THIS DOCUMENT AT ANY TIME.

\8500-0005D

Data Rescue 3 Users Guide 2

Table of Contents

1 Introduction............................................................................................................................................7

1.1 Welcome.......................................................................................................................................... 7

1.2 What Makes Data Rescue Different? ............................................................................................. 7

1.3 Latest version of the software......................................................................................................... 7

1.4 Program Setup................................................................................................................................. 7

1.5 Uninstall the Software..................................................................................................................... 8

1.6 Launching and Activating the Software.......................................................................................... 8

1.7 Technical Support............................................................................................................................ 8

1.8 Contact Prosoft Engineering........................................................................................................... 8

1.9 Data Rescue Demo – Risk-Free Trial..............................................................................................9

2 About This User Guide..........................................................................................................................10

2.1 User Guide Organization...............................................................................................................10

2.2 Conventions...................................................................................................................................11

2.3 User Experience Level.................................................................................................................. 11

2.4 System Requirements.................................................................................................................... 11

2.4.1 Hardware................................................................................................................................11

2.4.2 Software.................................................................................................................................12

2.5 General Usage.............................................................................................................................. 12

2.6 Basic Recovery Tips......................................................................................................................12

2.7 CAUTION: Drives with suspected Hardware Problems...............................................................13

3 Installing and Starting Data Rescue...................................................................................................... 14

3.1 Install/Uninstall Data Rescue........................................................................................................ 14

3.2 Before you start Data Rescue........................................................................................................ 15

3.2.1 Note on Data Rescue's Workspace.........................................................................................15

3.3 Starting Data Rescue..................................................................................................................... 16

4 Using Data Rescue................................................................................................................................ 18

4.1 Arena and Detail View...................................................................................................................18

4.2 Step 1: Selecting a drive or volume to scan.................................................................................. 18

4.3 Step 2: Choose a Task....................................................................................................................20

4.3.1 Canceling a Scan....................................................................................................................21

4.4 Step 3: Find and Select Files......................................................................................................... 22

4.4.1 Previewing Files........................................................................................................................ 23

4.4.2 Searching the Scan Results....................................................................................................24

4.4.3 Recovering Files.................................................................................................................... 25

Data Rescue 3 Users Guide 3

5 Tasks......................................................................................................................................................27

5.1 Quick Scan................................................................................................................................... 27

5.2 Deep Scan.....................................................................................................................................27

5.3 Deleted Files Scan........................................................................................................................ 28

5.4 Clone............................................................................................................................................ 28

5.5 Analyze.........................................................................................................................................30

5.6 File IQ...........................................................................................................................................32

5.6.1 File IQ Advanced Options.........................................................................................................33

5.6.2 File IQ Troubleshooting.........................................................................................................35

6 Manage Scans and Workspace.............................................................................................................. 36

6.1 Resuming Suspending Scans.........................................................................................................37

6.2 Saving Scans..................................................................................................................................37

6.3 Importing Scans.............................................................................................................................37

6.4 Deleting Previous Scans................................................................................................................38

6.5 Reviewing Previous Scan Results................................................................................................. 38

7 Preferences............................................................................................................................................ 40

7.1 General Preferences.......................................................................................................................40

7.2 Preview..........................................................................................................................................41

7.3 Scan Engine ..................................................................................................................................42

7.3.1 Analyze Preferences...............................................................................................................43

7.3.2 Cloning Preferences...............................................................................................................43

7.3.3 File Modules.......................................................................................................................... 44

7.3.3.1 Top Level File Modules Preferences............................................................................. 45

7.3.3.2 Category Level Preferences........................................................................................... 45

7.3.4.3 File Module Preferences................................................................................................ 46

7.4 Recovery Preferences.................................................................................................................... 46

7.5 Scanning Preferences.................................................................................................................... 47

8 Expert Features..................................................................................................................................... 48

8.1 Expert Preferences.........................................................................................................................48

8.2 Expert Menu.................................................................................................................................. 48

8.2.1 Allocation Blocks Layout...................................................................................................... 48

8.2.2 Choose Drive/Volume for Scan............................................................................................. 49

8.2.3 Show Details..........................................................................................................................50

8.2.4 Block Level Tools.................................................................................................................. 50

8.2.5 Refresh Volume List.............................................................................................................. 51

8.2.6 Add File to Scan.................................................................................................................... 51

8.2.7 Set Drive/Volume Parameters................................................................................................51

8.2.8 Add RAID Set........................................................................................................................52

8.2.9 Node Inspector.......................................................................................................................54

Data Rescue 3 Users Guide 4

9 Concepts................................................................................................................................................56

9.1 Selecting a Volume or Drive to Scan.............................................................................................56

9.2 File Systems and Catalogs.............................................................................................................58

9.3 Catalog Scans................................................................................................................................ 60

9.4 Content Scan..................................................................................................................................61

9.5 Deleted Files Scan......................................................................................................................... 62

9.6 Scan File........................................................................................................................................ 62

9.7 Allocation Blocks and Media Blocks............................................................................................ 64

9.8 Locating your file after a Scan, Revisited..................................................................................... 65

9.8.1 Locating a file found by a Catalog Scan................................................................................65

9.8.2 Locating a file found by Content Scan.................................................................................. 66

10 Troubleshooting and Frequently Asked Questions............................................................................. 67

10.1 Data Rescue seems to freeze. What should I do? .......................................................................67

10.2 Why doesn't my drive or volume show up? ............................................................................... 67

10.3 Why are some files listed twice? ................................................................................................67

10.4 Why do my found files total more than the size of the original drive? ...................................... 68

10.5 Why is there a delay when I click the mark checkboxes? ..........................................................68

10.6 Does Data Rescue handle RAID volumes? ................................................................................68

10.7 I recovered files, but they won’t open. What’s wrong? ..............................................................69

10.8 Can I recover files that I deleted accidentally? .......................................................................... 69

10.9 What are Data Rescue's general content scan capabilities? .......................................................69

11 Glossary...............................................................................................................................................71

Data Rescue 3 Users Guide 5

Table of Figures

Figure 1: Changing Workspace................................................................................................................ 15

Figure 2: Authentication Window............................................................................................................ 16

Figure 3: Choosing a Home Folder..........................................................................................................17

Figure 4: Data Rescue Activation Window.............................................................................................. 17

Figure 5: Media Selection Screen (Arena View)..................................................................................... 18

Figure 6: Media Selection Screen (Detail View)..................................................................................... 19

Figure 7: Task Selection Screen (Arena Menu)....................................................................................... 20

Figure 8: Cancel Confirmation Prompt....................................................................................................21

Figure 9: Scan Results Window............................................................................................................... 22

Figure 10: Preview Window.....................................................................................................................23

Figure 11: Search Results Window.......................................................................................................... 24

Figure 12: Find Prompt............................................................................................................................ 25

Figure 13: Clone Target Prompt...............................................................................................................29

Figure 14: Good Analyze Graph.............................................................................................................. 30

Figure 15: Bad Analyze Graph.................................................................................................................31

Figure 16: File IQ Window...................................................................................................................... 32

Figure 17: Advanced Options.................................................................................................................. 33

Figure 18: Manage Scans and Workspace................................................................................................36

Figure 19: Previous Scan Results.............................................................................................................38

Figure 20: General Preferences................................................................................................................40

Figure 21: Preview Preferences............................................................................................................... 41

Figure 22: Modifying Maximum File Size.............................................................................................. 43

Figure 23: File Modules Category........................................................................................................... 44

Figure 24: Non Editable Preferences....................................................................................................... 45

Figure 25: Specific File Module Preferences...........................................................................................46

Figure 26: Choose Drive/Volume Window.............................................................................................. 49

Figure 27: Set Drive/Volume Parameters.................................................................................................51

Figure 28: Add RAID Set.........................................................................................................................53

Figure 29: Node Inspector Window......................................................................................................... 55

Figure 30: Drives vs. Volumes................................................................................................................. 56

Figure 31: Drive / Volume Selection........................................................................................................57

Figure 32: File System Data Storage and Catalog Structures.................................................................. 59

Figure 33: Saving Scan File..................................................................................................................... 62

Figure 34: Importing Previous Scan files

..................................................................................................................................................................63

Figure 35: Media and Allocation Blocks................................................................................................. 64

Data Rescue 3 Users Guide 6

1 Introduction

1.1 Welcome

Thank you for purchasing Data Rescue 3.

Prosoft Engineering's Data Rescue 3 is an easy-to-use utility to help you recover files and folders from
crashed or corrupted hard drives, floppy disks, or removable cartridges. Recovered data is saved to
another medium, leaving the original disk untouched.

1.2 What Makes Data Rescue Different?

The main objective of Data Rescue is that the strategy for finding lost files is different and better from
the strategies used by other tools. Not only will it find your data in situations where other tools fail, but
it will also recover them in a much better condition, restoring icons, dates and even folder hierarchy.

Data Rescue is the only utility that focuses on data recovery as opposed to hard drive repair. Your entire
hard drive is examined for file content. This is one of the reasons that Data Rescue is more successful
than “repair” utilities on the market. The data on the drive is painstakingly evaluated and files are
meticulously re-assembled and stored in a safe location. Either with intense manual evaluation, or with
the help of powerful software tools, this is the process that data recovery professionals routinely use to
restore their client's data.

Why? Because this is the only reliable way to safely recover your data.

1.3 Latest version of the software

Check our web site http://www.prosofteng.com to find out if you have the latest version of this
software. If you already have a copy of Data Rescue 3 installed and an active internet connection, Data
Rescue 3 will inform you when an update is available when launching the program.

If you do not have the latest version of Data Rescue 3, download it from the website using your serial
number.

Note: serial numbers are compatible with all versions having the same main version number. Data
Rescue 3 will not accept serial numbers from Data Rescue II or earlier.

1.4 Program Setup

Data Rescue installation is very easy. Simply drag the Data Rescue 3 application file from the DVD (or
from the mounted disk image if you downloaded it from the website) and drop it into your Applications
folder or elsewhere if you wish. Caution: do not install Data Rescue 3 on (or make any other changes
to) a volume from which you want to recover files. Doing so may reduce the chances of recovering
files from that volume.

Data Rescue 3 Users Guide 7

1.5 Uninstall the Software

► ► To remove this software from your hard drive:

1. Quit Data Rescue 3.

2. Move the Data Rescue 3 application to the Trash

1.6 Launching and Activating the Software

Double-click the application icon to run Data Rescue. At first launch, you will be prompted to enter
your serial number (sent to you by email, or provided on a card in your DVD case).

This serial number will activate all the features of Data Rescue. Please keep this number in a safe place
for reinstallation, upgrades, and technical support.

1.7 Technical Support

Our technical support is free and can be accessed by email, fax or phone. Please have your serial
number and the version number ready before calling. If you have questions about this user guide or
using Data Rescue 3, please contact technical support:

• Support FAQs: http://www.prosoftengineering.com/support

• Email Address: [email protected]

• Phone Number: [phone]

• Fax Number: [phone]

• Mailing Address: Prosoft Engineering, Inc.

303 Ray St.
Pleasanton, CA 94566

• Support Hours: Monday – Friday, 7AM – 5PM (PST)

1.8 Contact Prosoft Engineering

If you have comments about Data Rescue 3 or wish to purchase a serial number, please contact our
sales department:

• Website: http://www.prosoftengineering.com/products/data_rescue.php

• Email Address: [email protected]

• Phone Number: [phone]

Data Rescue 3 Users Guide 8

1.9 Data Rescue Demo – Risk-Free Trial

You can use an unregistered copy (demo mode) of Data Rescue to scan for files. The demo works
exactly as the fully licensed version would, which will allow you to see all the files that are available
for recovery. However, the demo mode only allows you to recover one single file, no larger than
10MB.

Once you have confirmed that Data Rescue can indeed see the files that you wish to recover, you can
simply purchase a copy of Data Rescue 3 from www.ProsoftEngineering.com and a serial number will
be immediately sent to you via email. Since Data Rescue 3 will not try and modify your disk, you can
test out the software without the worry of “making things worse” like you can with other disk utilities.
However, if your disk is having hardware problems, please see Section 2.7 for more information about
Drives with Suspected Hardware Problems.

Data Rescue 3 Users Guide 9

2 About This User Guide

This guide contains both instructions on how to use Data Rescue and reference information on the
concepts one needs to know about files and how the files are recovered. It is a “how to” user guide, so
the reference material is in chapters separate from instructional chapters. If you are trying to look up a
concept, use the glossary and the index.

In addition, it is important to understand that Data Rescue is a file recovery utility, not a file repair
utility. This guide endeavors to help distinguish the difference between recovery and repair.

2.1 User Guide Organization

This guide is divided into the following chapters:

Overview: Provides a brief introduction to Data Rescue, describes system requirements, and explains
conventions used in this guide.

Installing and Starting Data Rescue: This chapter provides instructions for quickly installing and
starting Data Rescue for the first time.

Using Data Rescue: This chapter walks the user through a simplified procedure for volume selection,
scan selection, and file recovery with a minimum of technical information. This procedure should
suffice for most users. If this does not result in recovery of the desired files, the user can then refer to
later chapters for a more in-depth presentation.

Preferences: Provides instructions on using Data Rescue options and preferences.

Expert Features: Provides instructions on using Data Rescue's other capabilities not covered in the

earlier simplified procedure.

Concepts: This guide explains the concepts needed to understand and use the more advanced Data
Rescue capabilities and options.

Troubleshooting: Provides important troubleshooting information.

Glossary: Provides short definitions of important or common Data Rescue terms.

Data Rescue 3 Users Guide 10

2.2 Conventions

The following conventions are used in this guide:

Convention Description

Text in bold type Text for GUI-based commands that are often part of a

menu or dialog, is printed in bold type:

Click Start Rescue to begin.

Text in monospace type Text used to represent names of directories, files, and

paths is printed in a monospaced font:

/Users/Home/Documents/Word.doc

Monospace italic text in angle brackets (< >) Text used as a place holder for variables is printed in an

italicized monospaced font and placed in angled
brackets:

<logicalblock> = (<allocationblock> x
(allocationblocksize>) +
<filespaceoffset>)

Text in a bold type, offset by a “►” Text used to introduce a set of step-by-step procedures

is printed in bold, and offset by an arrow (►):

► ► To install Data Rescue:

1. Double-click the ….

2.3 User Experience Level

This guide assumes that the reader is familiar with the Macintosh computer, including how to use the
mouse, select menu items, and so on. If you are not familiar with how to perform basic functions like
these on a Macintosh, please read the documentation that came with your computer.

2.4 System Requirements

2.4.1 Hardware

Compatible hardware includes all computers developed in the last 3 years including G4/G5/Intel
PowerBooks, MacBooks, MacBook Pros, iMacs, and desktop machines. Data Rescue needs at least
512MB of RAM to run (1GB is recommended). A second hard drive with sufficient free space is
needed for Data Rescue's workspace, and to recover files to1.

1This drive must include free space for the recovered files and for Data Rescue's workspace, which can
be estimated at 1% to 2% the size of the volume or drive to be scanned. It is recommended that the hard
drive used for the workspace storage be locally attached, and if external, be attached via Firewire, USB

Data Rescue 3 Users Guide 11

2.4.2 Software

Data Rescue 3 is designed to run on Macintosh computers capable of running Mac OS X 10.4.9 or later
and includes support to recover data from hard drives formatted with HFS or HFS+ partitions. Data
Rescue 3's animated interface requires Mac OS X 10.5 or later. Data Rescue 3 also includes limited
support for recovering files from non-HFS/HFS+ disks and media (see Section 9.4 for more
information about Content Scan).

2.5 General Usage

Data Rescue was designed to be used in a wide range of situations. Specifically, Data Rescue can
handle:

• Any type of media which appears as a disk device with 512 byte sectors (floppy disk, hard disk,

Zip, Jaz, CF camera cards, etc.)

• Volumes which can't be mounted, even if the driver is damaged

• Disks with a damaged partition map

• SCSI, IDE (also called ATA or PATA drives), SATA, FireWire and USB drives

• HFS and HFS+ (“Mac OS Extended”) formatted partitions

• Limited support for non-HFS/HFS+ file systems (FAT32, NTFS, UFS, etc.)

• Large volumes (1 TB and larger)

• Password-protected volumes (if data is not scrambled/encrypted)

• Non-Roman-script (e.g Japanese) file names

• Recovery of fragmented files

However, you should be aware that Data Rescue will not be useful in all situations. A demo version of
Data Rescue may be downloaded from http://www.prosoftengineering.com to test whether it can find
your files.

Also, be aware that you need disk space on another device for Data Rescue's temporary working space,
and to recover your data. This must be a separate drive from the drive you are trying to recover from, in
order to avoid altering that drive. Data Rescue offers the most extensive, safe recovery of your
important data. Because your corrupt drive is not stable, Data Rescue will not allow you to try and save
files to the same drive, nor will Data Rescue try and “repair” that corrupt drive (doing so could actually
cause more corruption and data loss).

2.6 Basic Recovery Tips

This section will provide you basic tips to help you improve your chances of recovering your data
before using Data Rescue.

Prevent writing to the hard drive. Once you are aware you are missing data, immediately quit all
programs you are using and turn off the computer. Further writing to the hard drive may overwrite data
you are trying to recover. This includes creating new documents, browsing the Internet, or running disk
repair utilities to attempt to fix the drive.

2.0, eSATA or a similarly fast interface.

Data Rescue 3 Users Guide 12

Evaluate the situation. Every data recovery scenario is different and may require different approaches
to recover the data. Read “Installing and Starting Data Rescue” in chapter 3 to determine the best
method for recovering data in your situation.

A second hard drive with adequate space is necessary to recover data and host Data Rescue's
workspace. If you have a second internal hard drive in your computer or an external USB/Firewire

hard drive attached to your computer, you may use it for this purpose. Make sure you have enough free
space to hold the data you wish to recover, plus an additional amount of 2% the size of the volume or
disk being scanned. For example, if you need to recover 25GB of data from the bad hard drive, you will
need at least 25GB for the recovered files and 0.5GB of free space for the workspace. In certain
situations, recovered files will require more space than they occupied on the original drive.

Consider acquiring a replacement hard drive. If you do not have a second hard drive to recover to,
you may want to acquire a new hard drive. If your hard drive is physically failing, a replacement hard
drive will be necessary to maintain your data. Not only will the new hard drive help you with your
recovery immediately, but the new hard drive may also be used as a backup hard drive in the future
when your recovery is complete.

2.7 CAUTION: Drives with suspected Hardware Problems

Even though Data Rescue exercises caution to never damage your drive's data by writing to it, there are
certain types of drive hardware failures which due to their nature can cause additional damage to the
media and data just by continuing to use the drive.

One example of this kind of damage is a crashed disk head, which could potentially cause additional
media scratching and data loss with continued use. One clue to this type of damage may be unusual
mechanical sounds emanating from the drive. If you suspect this type of damage, and the data on the
disk is extremely critical, you may wish to send your drive to a professional drive recovery service with
clean-room facilities.

The cost of professional recovery services can run into the thousands of dollars. If you suspect
hardware damage, but need to avoid the expense of the professional services, you can minimize the
chances of further damage to your drive by first cloning it to a spare drive, then do the recovery on the
clone. See Section 5.4 for more details on using the Clone function.

Data Rescue 3 Users Guide 13

3 Installing and Starting Data Rescue

This chapter provides basic instructions on installing and starting Data Rescue. If you are using Data
Rescue for the first time, you should read this chapter in detail.

3.1 Install/Uninstall Data Rescue

If you have the Data Rescue bootable DVD, it is not necessary to install Data Rescue and you may boot
from the Data Rescue DVD to run the program.

If you plan on installing Data Rescue to a disk, you should NOT install it on the disk you are trying to
recover files from. If you are trying to recover files from a disk that you normally use as a boot drive,
you will need to either boot from the Data Rescue bootable DVD, or else set up a different drive to
boot from and install Data Rescue on that drive. You may install Data Rescue on your recover /
workspace disk and run it from there. It does not necessarily have to be installed on or run from your
boot disk.

The following are instructions for users with a download version of Data Rescue.

► ► To install Data Rescue:

1. From the location to which you downloaded Data Rescue, double-click on the Data Rescue
image (.dmg) file to mount it on your computer.

2. Drag the contents of the Data Rescue drive (the mounted disk image) to your Applications
folder or elsewhere, if desired.

► ► To uninstall Data Rescue:

1. Drag the Data Rescue application into the trash.

The following are instructions for users using the bootable emergency DVD. Booting from the
emergency DVD is ideal for situations where files were accidentally deleted or the operating system
fails to boot from the internal hard drive:

► ► To boot from Data Rescue:

1. Insert the Data Rescue DVD into the DVD Drive.

2. Restart the computer holding the “C” key.

3. Continue holding the “C” key until the Apple logo is displayed.

Data Rescue 3 Users Guide 14

3.2 Before you start Data Rescue

After you have installed Data Rescue (using a downloaded version) or booted your system from the
Data Rescue DVD in your system's DVD drive (using a bootable disc), you are ready to begin using
Data Rescue.

Data Rescue requires access to a safe location for its workspace files and to store your recovered files.
In the interests of performance, your best option is to plug in an external, freshly formatted hard drive
through the USB 2.0, FireWire or eSATA connection on your computer, or to use a separate internal
drive. Make sure the capacity of this drive is great enough to contain all the files you plan to recover
from your damaged hard drive, plus space for Data Rescue's workspace files. Data Rescue will prompt
you with a warning if a second drive is not found.

It is not recommended to try and use a slow drive such as a network drive, USB 1.0 drive, etc. for
temporary storage because doing so will have a severe performance impact on Data Rescue.

3.2.1 Note on Data Rescue's Workspace

When Data Rescue scans, it uses a workspace folder to hold files of information pertaining to the scan.
By default, this is located on your boot drive, but can be changed via the Manage Workspace menu
item. Since writing files to a volume being scanned would compromise the ability to recover files, Data
Rescue will not allow the workspace to be in the same volume that is being scanned. If there is a
conflict, Data Rescue will prompt you to choose a different locations for the workspace, as shown in
Figure 1. Data Rescue will also prompt you if there is not enough adequate free space for a scan. In this
event, choose a different volume with more free space. The workspace may, but does not have to be, on
the same volume that you will use to recover.

Figure 1: Changing Workspace

Data Rescue 3 Users Guide 15

3.3 Starting Data Rescue

Launch the application by double-clicking the Data Rescue icon in the Data Rescue folder. If Data
Rescue has not been run before, an authentication window will be displayed, as shown in Figure 2. This
prompt authorizes Data Rescue to access your disk devices with special privileges.

Figure 2: Authentication Window

Enter the username and password of an Administrative user. (If you are the only user of your system,
then you are most likely the administrative user, and you can use your own name and password.) If you
do not have an administration password for your computer, please contact your system administrator to
log in for you.

Note: In versions of Data Rescue prior to Data Rescue 3, each time the system was booted from the
boot CD/DVD, it was necessary to re-enter the serial number every time. Also, if any non-default user
preferences were needed, they would have to be re-set. Data Rescue 3 improves on this situation when
booted from the DVD by allowing you to show it where your home folder is (if it is accessible) and
read the serial number and user preferences from there, thus avoiding the need to enter the information
again. Even if the home folder is not accessible, Data Rescue 3 will allow you to specify a new “home
folder” somewhere (the volume you are using for your workspace and recovered files is usually a good
place), and then after entering the serial numbers and preferences, they will be saved there. If you need
to run Data Rescue again and have the same volume is attached, you can choose that same folder and it
will read the information from there. See Figure 3.

Data Rescue 3 Users Guide 16

Figure 3: Choosing a Home Folder

After clicking the OK button and Data Rescue has not been activated yet, an activation window will
appear as shown in Figure 4.

Figure 4: Data Rescue Activation Window

If you have a serial number, enter your name and serial number information and click on Activate to
enable the full features of the software. If you are sampling Data Rescue, click on the Demo button. In
Demo mode, Data Rescue will allow you to scan the drive, but you will only be able to recover one file
of 10MB or less.

Data Rescue 3 Users Guide 17

4 Using Data Rescue

Data Rescue has been redesigned to make it as simple as possible to scan and recover your files by
guiding the user through 3 steps.

4.1 Arena and Detail View

There are two different views to select your drives: Arena View and Detail View. The Arena View
provides an animated interface to guide you through the recovery process. The Detail View provides a
classic interface for those who are familiar with previous versions of Data Rescue. You may change the
view modes by clicking on the Detail/Arena View button on the bottom left corner of the window.

Data Rescue 3's animated interface requires Mac OS X 10.5 or later to display the Arena View.
Mac OS X 10.4 will not have the Arena View available and will display the Detail View by default.
You may also manually disable the animated interface in Data Rescue's Preferences.

4.2 Step 1: Selecting a drive or volume to scan

Figure 5: Media Selection Screen (Arena View)

The first step is to select the hard drive or volume that is missing the files. This step shows a list of all
the disk drives and volumes that Data Rescue can see on the system.

► ► To select the drive or volume:

1. Click on the hard drive or volume icon.

2. Click on the Next button.

Data Rescue 3 Users Guide 18

Figure 6: Media Selection Screen (Detail View)

Data Rescue shows a two-level list of all the disk drives and volumes. The first level shows the
hardware names of the whole drive, which may include the make and/or model of the hard drive. This
will scan the entire hard drive with any partitions.

The second level shows the volumes that belong to the hard drive. In most cases, you will want to
select the volume first if it is available. In the Arena view, the second level of volumes will be
displayed only if your hard drive has two or more volumes. Volumes that are not mounted will be listed
with a gray (dimmed) font, as shown in Figure 6. Although this may indicate volume corruption, the
volume may be selected to be scanned.

The following lists will help you determine what to select based on your situation.

Select the hard drive name if:

• The volume is not listed

• The hard drive was reformatted or repartitioned

• No data is found by a Quick Scan on the volume

Select the volume name if:

• You are looking for deleted files

• The volume failed to mount, but shows in the list

Data Rescue 3 Users Guide 19

4.3 Step 2: Choose a Task

Figure 7: Task Selection Screen (Arena Menu)

The second step is to select the task to perform on the volume or hard drive. This step will let you
choose to scan, clone or analyze your volume or hard drive.

► ► To choose a task:

1. Click on the icon for the task you would like to perform.

2. Click on the Start button. Wait for the Scan Process to complete.

Data Rescue 3 provides a variety of functions to help search for the data on your hard drive. Each scan
method is designed to help recover different scenarios. See Section 5 for more information about Data
Rescue 3's tasks.

Data Rescue 3 Users Guide 20

4.3.1 Canceling a Scan

Figure 8: Cancel Confirmation Prompt

After clicking the Start button, Data Rescue 3 will begin its scan process on the hard drive. You may
interrupt the scan process at any time by pressing Cancel. A prompt will confirm if you want to cancel
the process. To cancel the scan in progress, click on the Cancel button in the prompt. To close the
prompt and return to the scan, click on the Continue button. If you are using a Deep Scan or Deleted
Files Scan, the confirmation prompt will have two additional choices for Suspend and End Early.

Selecting the Suspend option will save your current progress, allowing you to continue the scan where
you left off later on, even if you have quit Data Rescue or rebooted your system in the meantime. This
is a helpful option if you have to temporarily stop the scan and continue at a later time. Suspended
scans can be reloaded later through the Manage Scan and Workspace selection in the File menu. See
Section 8 for more information about loading suspended scans.

Selecting the End Early option will force Data Rescue 3 to end its current scan and provide results up
to that point of the scan. This is a helpful option if you are having difficulties scanning a hard drive due
to bad blocks or slow reads. Please note that ending the scan early will end only the first phase of Data
Rescue 3's scan process, and will still progress through the next two phases of the scan process to
catalog the results. The results from the ended scan may take up to an hour to process. Allow adequate
time for the results to be processed.

Data Rescue 3 Users Guide 21

4.4 Step 3: Find and Select Files

Figure 9: Scan Results Window

The third step is to mark the files and folders to be recovered. Marking a folder will automatically mark
all the files and folders contained within the folder.

Data Rescue 3 will organize files into two different folders: Found Files and Reconstructed Files. The
files found by Data Rescue will be organized depending on the scan method you use.

Found Files will be listed in the results window when using a Quick Scan or Deep Scan. Found Files
displays any files from any file systems it detects, listing original directory structures and file names.
You will want to look through the Found Files results if you are recovering from a hard drive that has
failed to boot to the operating system or if your external hard drive is failing to mount.

Reconstructed Files will be listed in the results window when using a Deep Scan or Deleted Files
Scan. The Reconstructed Files results will organize any found files by category and file type. These

results will NOT have their original directory structure and will usually not have their original file
names since they are found by file patterns. You will want to look through the Reconstructed Files
results if you are recovering from a hard drive that was accidentally reformatted or had files that were
accidentally deleted.

We do not generally recommend selecting and recovering all of the Found and Reconstructed files
simultaneously, especially from a Deep Scan. It is generally better to spend a little time to select and
recover just the files and folders you want. For example, Deep Scans typically contain huge amounts of

Data Rescue 3 Users Guide 22

Mac OS files and folders that will not be useful when recovered, and will just increase the time and
space needed for the recovery. You can browse and/or use the search feature to help locate files you are
interested in.

In addition, if you intend to recover many files under Found Files, we recommend that you start by
recovering a few important files first, then verify that the files open properly before recovering the rest
of the listed files.

4.4.1 Previewing Files

Data Rescue 3 allows you to preview major file types before recovering the files. This will help
determine whether the files can be recovered properly before being transferred onto another hard drive.
Major file types such as .doc, .pdf, .mp3, and .jpeg can be previewed through Data Rescue 3, as shown
in Figure 9.

Figure 10: Preview Window

► ► To preview files within Data Rescue 3:

1. Click on a file's name within the list to highlight it.

2. Click on the Preview button or press the space bar on the keyboard to view a thumbnail of the
image or an overview of the document.

Data Rescue 3 Users Guide 23

As a convenience to the user, double-clicking on a file in the Scan Results window will cause the file to
be temporarily recovered into Data Rescue's workspace and the operating system will open the file with
the appropriate application. For example, double-clicking on a .mov movie file will open the default
media player application, typically QuickTime. This double-click preview feature is only available
while booted directly from the operating system. The double-click preview is disabled in Demo mode
and when booted from the DVD.

► ► To preview files within their default application (while booted from the operating system):

1. Double-click on the file you want to preview.

4.4.2 Searching the Scan Results

The search feature will allow you to quickly filter your results and find your most important files. If
you are looking for a specific file, you may use the Search Field in the Scan Results window or click
on the Edit menu and select Find.

Figure 11: Search Results Window

The Search Field in the Scan Results window can be used to quickly filter the results for specific
filenames or extensions. The Scan Results window will be updated with any files that match the
extension or word within the filename. Highlighting a file from the list will display the path to the file
on the bottom half of the window. Please note the Search feature does NOT look within the contents of
the files for keywords.

Data Rescue 3 Users Guide 24

► ► To use the Search Field:

1. Click in the Search Field and type in a file name or extension.

2. Press the Return key on the keyboard, or click on the Search button. Allow adequate time for
the results to filter and update the list.

The Find feature in the Edit menu allows you to search for specific criteria of a file, including file
name, date created, and file size as shown in Figure 12. This allows you to filter out a range of files if
you remember the date created or file size.

Figure 12: Find Prompt

► ► To use Find Feature:

1. Click on the Edit drop down menu and select Find.

2. Select the parameters for the file you are trying to find and click on Search.

After viewing the Search results, you may return to the complete Scan Results by clicking on the View
drop down menu, and selecting Scan Results. Any files marked for recovery in the Search results will
remain marked for recovery when returning to the Scan Results.

4.4.3 Recovering Files

While previewing the files, you may begin marking any files to recover. You may choose to recover
each file individually or in groups by marking multiple files and pressing the Recover button, or
dragging and dropping files into a Finder window to recover them to the destination hard drive.

After completing a scan and before recovering a large number of files, it is highly recommended to first
try and recover only a few of your important files to make sure they contain good data. There are some
situations where there can be uncertainty about the proper Allocation Block Layout choice (see Section

8.2.1 for more information about Allocation Block Layouts).

Specific files can be marked for recovery by using the checkboxes within the Scan Results list. This
allows you to choose multiple files throughout the scan results to be recovered as one process. If you
would like to recover all the possible results from your hard drive, you can mark the root selections
Found Files and Reconstructed Files, however it is generally best to select specific files and folders
you want to recover to save time and hard drive space.

► ► To recover files using the checkboxes:

1. Click on the checkboxes to mark any files you are interested in recovering.

2. Click on the Recover button.

3. Select the destination for your files to be transferred to and click on Open. Allow adequate time
for the files to be transferred onto the destination.

Data Rescue 3 Users Guide 25

The “drag and drop” recovery process is the quickest way to move a file or folder to the destination
hard drive if you are booted from your operating system. However, this method of recovery is not
available while booted from the DVD since the operating system's Finder windows are not available to
drag to a destination.

► ► To recover files using the drag and drop method:

1. Highlight the file or folder you want to recover.

2. Click and drag the highlighted file or folder from the Scan Results list onto the destination hard
drive or folder on Apple's Finder. Allow adequate time for the files to be transferred onto the
destination.

Data Rescue 3 Users Guide 26

5 Tasks

5.1 Quick Scan

Select the Quick Scan if:

• The internal hard drive's operating system fails to boot.

• An external volume fails to mount.

The Quick Scan is the fastest method that detects existing directory structures even if your volume
does not mount. This scan will detect files with their original folder hierarchies and file names. It is
recommended to try this scan method first if your volume is detected on the hard drive.

A Quick Scan can only be used on a volume. If you have selected the hard drive to be scanned, the
Quick Scan will attempt to search for the first available volume on the hard drive, then rebuild the
directory structure for that volume.

The Quick Scan typically takes a few minutes to complete, but may take up to a few hours to retrieve
the results in more severe cases. Bad blocks on the hard drive may slow down the scan process, but will
immediately speed up once it has overcome those bad blocks.

5.2 Deep Scan

Select the Deep Scan if:

• No volumes are detected on the hard drive.

• A hard drive was reformatted.

• The Quick Scan did not provide expected results.

The Deep Scan is a comprehensive scan method that provides the most results possible. The Deep
Scan is a two part scan method: 1) detects existing directory structures on the hard drive, 2) scan the

whole hard drive for any file patterns to rebuild the raw data of any recognized files.

As the first part of the scan, Deep Scan will detect any existing directory structures like the Quick
Scan, but can detect multiple directory structures while scanning hard drive with more than one
volume. This will provide you with results from each found volume, with their original directory
structures and file names.

The second part of the Deep Scan searches the entire hard drive for any files based on file patterns.
Data Rescue 3 detects over 150 major file types based on the files' raw data. These found files will not
have their original directory structure or filenames since Data Rescue 3 is rebuilding the files based on
their file design. Instead, these results will be provided with generic filenames and organized by
category in the Reconstructed Files folder.

The Deep Scan usually takes up to three minutes per gigabyte. With large capacity hard drives, it may
require several hours to complete a scan. Physical issues such as bad blocks on the hard drive may slow
down the scan process even longer, but the scan will immediately speed up once it has overcome the
bad blocks. Allow adequate time for the scan to finish.

Data Rescue 3 Users Guide 27

5.3 Deleted Files Scan

Select the Deleted Files Scan if:

• Files were deleted through the operating system.

• Files were deleted by another program.

• A fresh installation of an operating system overwrote an existing hard drive

The Deleted Files Scan is a specific scan method that searches only the free space of a volume for any
files based on file patterns. Scanning only the free space allows the Deleted Files Scan to specifically
detect any files that were deleted.

Once files are deleted through the Mac Operating System, there is no more reference to their original
directory structure, filename, or date created/modified. Data Rescue 3 will not be able to detect the
original information of that file in the directory structure. Instead, Data Rescue 3 will rebuild any files
that it detects based on its file patterns. The results of the Deleted Files Scan will be provided with
generic filenames and organized by category in the Reconstructed Files folder.

The Deleted Files Scan usually takes up to three minutes per gigabyte of free space available on the
volume. This makes the Deleted Files Scan faster than a Deep Scan since it is not scanning any known
used space on the volume.

5.4 Clone

Select the Clone feature if:

• The hard drive appears to be having some hardware problems

• Quick or Deep Scans are stating an excessive amount of time to scan

• You need an identical copy of the hard drive

The purpose of the Data Rescue cloning function is to copy a drive or volume to another drive or
volume, so that the copy may be scanned, reducing the wear-and-tear on the original hard drive. This
will free the hard drive from use while preserving the data that was on it for later scanning. Cloning is
normally not required in order to scan and recover files with Data Rescue. The goal is to transfer all the
data from the source to the destination, making a perfect one-to-one copy where it is possible. In some
cases, due to disk errors on the source, copying can be hindered to the point where getting a perfect
100% is not possible because of the huge slowdown in read rate caused by errors; then the goal
becomes transferring as much of the source data to the destination as possible within a certain time
period.

To use the Clone feature, a spare hard drive is needed with the same or larger capacity than the original
hard drive. The Clone feature makes a single pass copy of your hard drive onto another hard drive or
into a disk image. Please note the cloned hard drive will be in the same logical state as the original hard
drive. This means if the original hard drive is failing to mount or boot, the cloned hard drive will have
the same failure to mount or boot. The purpose of the clone is to help overcome any slow reads or
possible hardware failures that exist on the original hard drive.

Data Rescue 3 Users Guide 28

Figure 13: Clone Target Prompt

If the original hard drive appears to have hardware problems, it is highly recommended to clone the
hard drive first to reduce the use of the source drive while it is still operating. However, please note the
caution in Section 2.7 if your hard drive is making strange noises. Once the original hard drive is
cloned, you may put the original hard drive away for safekeeping and perform the recovery options on
the cloned hard drive.

► ► To Clone a hard drive:

1. Select the device level of the hard drive in Step 1.

2. Select the Clone task in Step 2.

3. Select the Clone Target where the hard drive will be cloned to and click on Start Clone. Wait
for the clone process to complete.

Cloning the device level will copy the entire hard drive's partition map onto the other hard drive. If
there are multiple partitions on the hard drive, the partitions will be cloned onto the destination as well.
You may select and clone volumes rather than the whole hard drive; however, this is only
recommended if you are instructed by Prosoft technical support or you have knowledge and experience
about disk partitions and volumes. Warning: The Clone process will overwrite the contents of the Clone
Target. Ensure you have a backup of the contents of the Clone Target hard drive, or use an empty hard
drive. Be extremely careful to choose the target so that you don't write to the wrong drive or volume.

Data Rescue 3 Users Guide 29

► ► To Clone to a disk image:

1. Select the device level of the hard drive in Step 1.

2. Select the Clone task in Step 2 and click on Continue.

3. Select New Disk Image as the Clone Target.

4. A prompt will appear to title the saved disk image. Give a title to the disk image and select the
destination for the disk image file and click Save.

5. Click on Start Clone. Allow adequate time for the clone process to complete.

Cloning to a disk image will allow you to save the entire contents of a hard drive into a single file. This
is a good option if you have available hard drive space, but do not want to erase the contents of another
hard drive. The disk image can be opened later to help simulate the original hard drive and complete a
scan for recovering files.

5.5 Analyze

The Analyze function verifies your hard drive's ability to accurately read data. Analyze can provide a
quick check of a hard drive or volume's ability to read data by sampling its read speeds throughout the
media.

► ► To Analyze a hard drive:

1. Select the hard drive/volume in Step 1.

2. Select the Analyze task in Step 2 and click on Start.

3. A pop up window will appear to select the analyze method. Select the Analyze method and click
on Start. Allow adequate time for the Analyze feature to complete.

Results for the Analyze feature will be displayed as a graph which represents the address for the block
versus the time taken to read the block. The red line on the graph represents the threshold in which data
can be read from the hard drive. A good hard drive/volume will display readings under the red line as
shown by the screenshot in Figure 14.

Figure 14: Good Analyze Graph

Data Rescue 3 Users Guide 30

Figure 15: Bad Analyze Graph

Read times which are above the red line in the graph show where the hard drive has taken significantly
longer than average to read as shown in Figure 15. If read times are above this line, it does not
necessarily mean there is anything wrong because the system may have become busy at that point of
the scan. However, if you repeat the analysis additional times, and the long read times persist in the
same range of address, this may indicate the disk is having trouble reading from those addresses due to
a disk problem.

Data Rescue 3 Users Guide 31

5.6 File IQ

Select the File IQ feature if:

• A file type you are searching for is not found

• You have a special file type that is not supported by Data Rescue 3

• You want to check if a file type is supported

If Data Rescue 3 does not recognize the file type you are trying to recover, File IQ will help Data
Rescue 3 to learn new file types. Data Rescue 3 will analyze any good working file samples and detect
any file patterns to help find missing files of that file type. File IQ will work for many, but not all types
of files (see Section 5.6.2 for File IQ Troubleshooting). However, Data Rescue 3 will tell you if your
sample files are likely to work or not, and there is nothing to lose by trying.

Figure 16: File IQ Window

► ► To add a new file type into Data Rescue 3:

1. Click on File IQ.

2. Click on the + icon to add file samples.

3. Choose any at least 5 files of the same file type.

4. Click on Open to add the files into the list.

5. Click on Save.

To utilize File IQ, Data Rescue 3 needs to analyze good working files of the same file type that is
missing. These may be older files that you have previously created with your program. You will usually
need to reference at least 5 files of the same filetype to properly create a file module; however in some
cases, as few as two files may work. In general, the more file samples provided into File IQ, the more
accurate the created file module will be. If you do not have sample files available, you may consider

Data Rescue 3 Users Guide 32

creating some files of the same file type with the program used to make the files. However, ensure
these files are not saved to the hard drive missing the data.

Click on the + icon or drag the sample files into the Add New Type window. A spinning progress
wheel will appear below the list to indicate the files are being analyzed. If no additional information is
reported back in Data Rescue 3, you may click on Save to add the file module to the Learned Types
List.

5.6.1 File IQ Advanced Options

Show advanced options displays some additional parameters that you may use to further define the
file module as shown in Figure 17.

Figure 17: Advanced Options

The Details tab includes some fields to describe the file type, how the file names will be generated, and
which folder they will appear in. Data Rescue 3 will automatically fill in most of the fields when
sample files are listed in File IQ. Data Rescue 3 will fill in the Template File name, Extension, Folder
Name, and Max File Size based on the sample files' data. The fields will define the following attributes
for the file module:

• Name is an optional field that you may fill in to describe the File module. This will be
displayed in the Preference's Scan Engine Tab.

• Template File Name is the generic name that will be provided to any found files.

• Extension is the file type determined by the file samples.

Data Rescue 3 Users Guide 33

• Folder Name is the location where the found files will be displayed in the scan results list.

• Max File Size limits the size of the data captured for the file. Ideally this should be large

enough that you are sure all files of this type are smaller than this limit. If in doubt, you may
make this value larger because files larger than this number will either not be found or will be
truncated when recovered. If you do not specify a value for Max File Size, Data Rescue will
choose a value that is about 10 times larger than the largest file sample you added.

The Quality tab will display two scales to detect the file patterns reliability for the file module.
Diversity relates to how many samples there are and how many samples have different lengths. The
Match Strength displays the number of similar bits found between the separate files. Data Rescue will
update these bars each time a sample file is added or removed. The larger the values are for both
Diversity and Match Strength, the more reliable the file module will be for Data Rescue to detect the
files.

If you're having trouble getting an acceptable set of samples, it is best to remove all the sample files
and add them one at a time. You can improve the Diversity by adding another sample file. If the Match
Strength suddenly decreases when you add another sample file, it may be because that file is actually
different in format than the samples you already added. In that case, remove that file and adding a
different one. Please remember that certain types of files do not have distinctive starting patterns, and
therefore will not be recoverable by example at all, not matter what combination of samples you give.
If you find that you cannot get both Diversity and Match Strength above half-way, see Section 5.6.2 for
File IQ Troubleshooting.

The Pattern tab allows you to modify the matching algorithm. The Matching drop down menu
instructs Data Rescue how selective to be in matching start patterns for the file type. The default
selection for Normal will give a basic comparison of the bits to determine the file pattern. If your scan
returns too many files that are not similar to the filetype, you may change the Matching selection to
Tight. This will make Data Rescue 3 compare more bits in the file pattern to potentially detect the files
more accurately and reduce the amount of results provided. If your scan returns too few files, you may
change the Matching selection to Loose to compare less bits in the file pattern and provide more scan
results.

If Data Rescue determines that the sample files have a usable and consistent end pattern, it will use
enable the Use End Pattern option. Using an end pattern should result in recovered files that have the
correct length, instead of potentially adding incorrect data. However, enabling the Use End Pattern
option may reduce the scan performance considerably and may take longer to complete the scan. If you
uncheck the Use End Pattern option, the end pattern will not be used for the scan.

Data Rescue currently does not support editing previously saved definitions. To change the Matching
selection, you will have to recreate the File IQ definition and save the different matching selected.

Once you click Save, new file types will immediately be installed in Data Rescue 3 to allow you to
search for their respective files.

Data Rescue 3 Users Guide 34

5.6.2 File IQ Troubleshooting

After dragging the sample files, you may be provided with a few different outcomes. This section
discusses some cases that may occur while trying to generate a file module.

The file samples may be recoverable by an existing module. If a file module is listed in the
“Recoverable by Existing Module” field, then it may not be necessary to create a file module. This
means the file samples you have provided are similar to another file module that Data Rescue 3 already
detects. The results you are provided by a scan may already detect your files, but you may need to
rename the extension to open the files properly by your program. As an alternative, you may choose to
save the file module to replace the existing module and a new scan of the hard drive will detect your
files properly. A common example of this are certain camera RAW images that are sometimes found as
TIFF images instead.

File IQ may not detect a suitable starting pattern for the sample files. If different programs create the
same kind of file, it's possible the files with the same extension may not have the same starting pattern,
and therefore won't produce a usable result. For example, Quark and FreeHand programs both create
EPS files, and if you took samples from both programs to create a file module, File IQ may report an
issue because the programs create different formats for the files. You may consider replacing some of
the sample files with other files of the same type. For best results, use file samples that are created from
the same program, and preferably the program that produced the files you are looking for.

There are cases in which File IQ cannot create a file module. Some reasons a file module may not be
created include:

• The files are packaged file types. These are files that appear as a single file, but are actually
folders with more data inside them. Since packaged files are made of multiple files, there is no
method to reconstruct the file as a whole. Common examples of packaged files are Application
bundles.

• Inconsistent file patterns. These are files that do not have common file patterns that can be
detected between the files due to different internal formats or raw data throughout the file. An
example of this may include database files.

• Repetitive file patterns. These are files that have a common file pattern that repeats multiple
times throughout the file that a correct end of file cannot be determined. An example of this is a
video file that has the same file pattern repeating every frame. This may result in a large number
of single frame video files, but not a complete video.

Data Rescue 3 Users Guide 35

6 Manage Scans and Workspace

Data Rescue 3 keeps the different scans that have taken place in its workspace. The Manage Scans
and Workspace feature allows you to continue a previously suspended scan or delete previous scans

which are no longer needed. By keeping previous scan results in the workspace, Data Rescue allows
you to return to the earlier scan results to recover additional files.

The Manage Scans and Workspace feature also allows you to select a different location for the
workspace folder. If the workspace location is changed, scans stored in the original workspace will no
longer appear, but any scans stored in the new workspace will appear. If the workspace is changed
back, the original scan results will once again appear.

Scans that are stored in the workspace are in a form that allows quick access to them. However, they
can take up considerable space. The Manage Scans and Workspace allows you to save one or more
scans in a compressed .drscan file, after which you could delete those scans from the workspace (see
section 6.2 for more information). Later if you want to restore any of those scans to the workspace, you
can load them from the previously saved .drscan file. This also works for suspended scans.

Figure 18: Manage Scans and Workspace

Data Rescue 3 Users Guide 36

6.1 Resuming Suspending Scans

Suspended scans may be resumed from the Manage Scans and Workspace window. Ensure the same
hard drive on which the scan was started is connected before resuming the scan.

► ► To resume a suspended scan:

1. Click on File and select Manage Scans and Workspace.

2. Highlight the suspended scan.

3. Click on the Option (gearwheel) button on the bottom left corner and select Resume.

The previous scan will begin immediately and continue where the scan was suspended.

6.2 Saving Scans

Saving scans allows a user to save the results of a scan into a .drscan file to be reloaded at another time.
This feature is primarily useful to archive scan results for access at a later time, or on the same
computer setup, without taking up workspace in the meantime. It could also be used when a scan needs
to be continued on another machine. For example, consider that an external hard drive has failed and a
scan was started on a MacBook, but the user decided they needed that MacBook for another purpose.
The user may save the the scan file onto a separate device (such as a USB flash drive), connect the
external hard drive to a different Mac computer, and import their scan with Data Rescue 3 from that
machine.

There are restrictions when resuming or accessing a saved scan. The scan must be accessed by the same
basic type of Mac (PPC or Intel based), running the same major MAC OS version, and either the same
or a compatible version of Data Rescue 3.

► ► To save a .drscan file:

1. Click on File and select Manage Scans and Workspace.

2. Highlight the scan(s) you want to save.

3. Click on the Option (gearwheel) button on the bottom left corner and select Save As.

4. Select a destination, title the file, and click on Save.

Please note that more than one scan can be saved, allowing you to archive multiple scan results into
one .drscan file. The file must be saved on a separate device, not on the hard drive or volume that is
missing the files.

6.3 Importing Scans

As described in the previous section, a scan can be imported from a .drscan file.

► ► To import a .drscan file:

1. Click on File and select Manage Scans and Workspace.

2. Click on the Option (gearwheel) button on the bottom left corner and select Import.

3. Select the saved .drscan file and click on Open.

4. A prompt will appear to “Choose Scans to Import”. Highlight the scans you want to load and
click on Import.

Data Rescue 3 Users Guide 37

The imported scans will be listed within the Manage Scans and Workspace window. Once imported,
you may select a suspended scan to continue, or go to the View menu and select Scan Results to view
any completed scans (see Section 6.5 for Reviewing Previous Scan Results).

6.4 Deleting Previous Scans

Data Rescue 3 archives all scans that it has completed within its workspace. These scans may take up
several hundred megabytes to gigabytes of space. After a scan is complete and the data has been
recovered from the drive in question, you may delete the previous scan from Data Rescue to reclaim
the space on the hard drive. Deleting the scan is recommended only when the recovery process is
completed. Once the scan results are deleted, the scan will need to be started from the beginning once
again if further results were needed.

► ► To delete a previous scan:

1. Click on File and select Manage Scans and Workspace.

2. Highlight the scan(s) you want to delete.

3. Click on the Option (gearwheel) button on the bottom left corner and select Delete.

4. A prompt will appear to confirm to delete the scan. Click on Delete to remove the scan.

6.5 Reviewing Previous Scan Results

Data Rescue 3 allows you to immediately review the results of any completed scans. This is very useful
in case you have forgotten to recover some files from the first attempt, or if you have to take a break
from the recovery process. If more than one scan is completed, Data Rescue 3 will list any previous
completed scans as shown in Figure 19.

Figure 19: Previous Scan Results

Data Rescue 3 Users Guide 38

► ► To review any previous scan results:

1. Click on View in the toolbar and select Scan Results.

2. If more than one scan was completed, select the completed scan from the list to load the results
of the previous scan.

If the previous scan you wish to view is not visible, click and drag the little gray button in the middle of
the left window area to the right until you can see the previous scan. Once the scan results have been
reloaded, you may resume recovering data from reloaded results.

Data Rescue 3 Users Guide 39

7 Preferences

The Preferences menu is available under the Data Rescue 3 menu bar at the top of the screen. The
Preferences menu is broken down into three sections: General, Preview, Scan Engine.

7.1 General Preferences

The General preferences includes settings for the interface, expert features, actions when quitting or
saving, checking for updates, and resetting the warning dialogues as shown in Figure 20.

Figure 20: General Preferences

Enable expert features will display a fourth section in the Preferences menu titled Expert. It will
enable a variety of additional features to help recover from advanced data recovery scenarios. The
expert features are designed for technicians or experienced computer users. See Section 8 for more
information about expert features.

Disable animated user interface will turn off all animations within Data Rescue 3. Disabling the
animated user interface is recommended if your computer has minimal memory or CPU speed.

Show disk images in Arena View will display any mounted disk images when in the animated Arena
view. You may disable this option if you are recovering data exclusively from hard drives.

The When Quitting section has two drop down menus to note the default behavior of Data Rescue 3
when exiting the application.

Data Rescue 3 Users Guide 40

The first drop-down menu selects what to do with the scan results when quitting:

• Save Scans - will automatically save the previous scan results. This is the default selection.

• Delete Completed Scans - will delete previous scan results. This is can be selected if you are

not concerned about your previous results.

• Show Manage Workspace – will display the Manage Workspace window before quitting the
program.

The second drop-down menu selects what to do with marked files from the Scan Results when quitting:

• Unmark marked files - will unmark any files that were selected for recovery.

• Leave marked files – will leave the marked files selected for recovery when loading those scan

results.

Scan Complete Sound and Recovery Complete Sound allows you to specify a specific sound to play
when the scan or recovery has finished.

Open Report on any error will open the Data Rescue Report window. Enabling this setting will allow
you to immediately view any of the errors that are reported by the program.

Check for updates automatically will detect whether there are any new versions of the software
available for download. This setting is enabled by default and will only check for updates if an internet
connection is available.

Use external help viewer allows help files to be opened by an external viewer instead of Data Rescue
3's viewer. When this setting is enabled, the default PDF viewer will be used to open the help files.

7.2 Preview

The Preview preferences include settings for Data Rescue's preview feature while viewing found files,
as described in Section 4.4.1.

Figure 21: Preview Preferences

Show Preview above other windows will keep the Preview window displayed at all times and prevent
the window from being hidden by other program windows.

Data Rescue 3 Users Guide 41

Make Preview opaque will remove the translucent effect from the Preview window when enabled.

Auto-play audio and video files will immediately play any audio and video files when the preview

window is opened for an audio or video file type.

Switch to Data view when Preview is not available requires Expert Mode to be enabled in General
preferences (see Section 7.1). Enabling this setting will display the raw data for unrecognized file types
in the Preview window.

7.3 Scan Engine

The Scan Engine preferences are additional settings for adjusting Data Rescue's scan processes.
Although there are many additional settings available, the default values should be fine for most
situations and users, so changing these settings should not be necessary. The Scan Engine preferences
are available to provide extra flexibility for expert users and in unusual circumstances where the default
settings are not providing substantial results.

The Scan Engine preferences are organized hierarchically and displayed as a tree. Highlighting a
portion of the tree in the left-hand window will cause any associated properties and values to appear in
the right-hand window. If you highlight a property, a description is displayed in the small text window
in the lower-right corner of the window. Properties with boolean (on/off) values are represented with a
checkbox. Properties with numerical or text values are shown with a text field that can change the
value. If a property is not editable, it will be shown in a gray font (dimmed). To edit a numerical or text
value, double-click the current value, then type in the new value.

For properties which represent file sizes, you can input a new value using KB, MB, or GB size
shortcuts. For example, to specify a size of 2 kilobytes, you can input either “2048” or “2KB”.

The most common need to access the Scan Engine preferences is to increase the maximum file size for
a certain file type when you expect to find very large files of this type. For example, the default
maximum size for most movie file types is 10GB. If you are looking for 25GB Quicktime movies, you
will need to go into the preferences and increase the maximum file size to something larger than the
biggest file you are looking for. An example of modifying this Quicktime file size is shown in Figure

22.

Data Rescue 3 Users Guide 42

Figure 22: Modifying Maximum File Size

Reset Scan Engine Preferences will changes all the Scan Engine Preferences back to default settings.
This is useful if you have previously changed any of the Scan Engine Preferences and would like to run
based on the default configurations.

The various scan engine preferences are discussed in the following sections.

7.3.1 Analyze Preferences

In these preferences, you can customize the size of the strides and the amount of data read on each
stride used for the Analyze function. For example, if the read buffer size is 2MB and the Quick Analyze
stride size is 128MB, then during a quick analyze, Data Rescue will read 2MB at media location 0, then
another 2MB at media location 128MB, etc.

7.3.2 Cloning Preferences

The Cloning Preferences are for advanced users who have special needs with regards to cloning. The
default cloning strategy should be adequate for almost all users and situations.

Data Rescue supports the following cloning strategies to help you accomplish this, which are described
below starting with the simplest approach.

Straight Copy – This straightforward strategy starts at the beginning of the source media, and
sequentially copies buffers of information to the destination media, one at a time, working straight
through from start to end. If read errors are encountered, the algorithm just keeps going through them
sequentially. If the disk should happen to have an area of errors close to the start of the hard drive, this
means the algorithm may spend many hours trying to work through this area, without having copied
much data.

Reverse Copy – This strategy is nearly the same as the straight copy, except that instead of working
from the start of the media to the end, it works from the end of the media to the start. In the

Data Rescue 3 Users Guide 43

aforementioned case where there were errors at the beginning of the media, this strategy can help by
allowing most of the data to be cloned before running into the problem area.

Bisect Copy – This strategy is influenced by the detection of errors found during the clone process.
The clone will start at the beginning and clone until an error is encountered. Once an error is detected,
the remaining space to clone is divided in half, then the clone process will continue from the second
half of the remaining space. After the second half is cloned, the clone will return to the first half of the
space to finish cloning. This process will repeat as more errors are detected on the hard drive.

Segment Copy – This is the default cloning strategy that is similar to bisect copy, but provides a more
elaborate and efficient method to clone the media. The space of the hard drive is divided into 64 pieces,
which are further subdivided if errors occur to ensure a clone of the healthy blocks of data while
ignoring any bad blocks. If there are no errors, it will proceed exactly like the straight copy from the
start to the end.

Most users should just use the default segment copy. The Reverse Copy method can be useful if the
user knows that most of the errors are near the start of the media, for example from using the Analyze
feature.

7.3.3 File Modules

The reconstructed files that are found by Deleted Files Scan or Deep Scan are based on individual file
modules. Each file module is responsible for detecting one kind of file. Most file modules have a
number of preference properties in common, such as enable, maximum file size, etc. The file modules
are grouped by category based on the file type. For convenience, some of the properties for the
individual file modules may be specified at the category level of the tree, which will allow all the file
modules of the same category to use the same values. Individual file modules may still override the
values from the category values. Figure 23 shows an example of the properties to be edited in for Data
Rescue's file modules.

Figure 23: File Modules Category

Data Rescue 3 Users Guide 44

7.3.3.1 Top Level File Modules Preferences

Enabled specifies whether a module is enabled to look for files during a scan. The default enabled
value for this node is On. All the file modules underneath this point of the tree will be enabled, unless
overridden at a lower level.

Number of filename digits controls how many numerical digits are used when generating names for
files found by the file modules. For example, with the default setting of 5, the filenames will be
generated as abc-00001, abc-00002, etc. Changing this setting to a value of 3 will generate file names
as abc-001, abc-002, etc. The purpose of the leading zeros is so the Finder will list these in numerical
order. Setting this value to 0 will have no leading zeroes added to the file name.

Maximum file size controls the maximum size that certain files can be. If a found file exceeds this
value, the file will be ignored. Not all file modules implement a maximum file size.

7.3.3.2 Category Level Preferences

The category level preferences consist of the categories of file modules, such as Mail, Documents,
Audio, etc. These categories are organized the same as the reconstructed file results. The preferences
that are inherited from the top-level file modules preferences are still shown so you can see their
values, but are not editable (dimmed), as shown by the example in Figure 24.

Figure 24: Non Editable Preferences

A few categories have their own properties. For example, the Text category is disabled by default
because its severe impact on performance and results. However, you may choose to enable the Text
category if you want to scan for a particularly important text document that is not recovered by any
other file module.

Other examples of unique preferences include Maximum consec bad chars for Text file modules to
help detect the end of a file properly and Minimum image dimensions for Video and Images.

Data Rescue 3 Users Guide 45

7.3.4.3 File Module Preferences

As shown in Figure 25, the lowest subcategory displays preferences for the individual file modules.

Figure 25: Specific File Module Preferences

The properties which are listed in green are preferences which are using a value from a higher place in
the tree.

7.4 Recovery Preferences

Bad file color will add a label color of your choice to any files detected by Data Rescue that were
potentially recovered as bad. The color label helps organize files when viewing them through the
Finder. These bad files may be attributed to incomplete file patterns or incorrect allocation block
layouts.

Change ownership will change the file and folder ownership for all recovered files to the user running
Data Rescue. This is helpful if the original hard drive was experiencing file ownership problems.

Clear lock will force change any lock bits when recovering files or folders when this preference is
enabled. This will allow any files or folders that were originally locked on the problem drive to be
accessed, renamed, or deleted by the user.

Copy buffer size preference specifies the size of the buffer to use for copy operations, such as
recovering files. A larger buffer size will improve the speed of the recovery of files, but will use more
memory.

Make items visible will change any invisible files to be visible when they are recovered.

Omit empty files will ignore displaying any files that are indicated to have no data when enabled.

Permissions promotion will change permissions of any recovered files to “Read and Write” based on

Data Rescue 3 Users Guide 46

the selected preference.

• None will not change any permissions on any recovered files.

• For items with no access will change permissions only for any files set as “No Access”.

• For all items will change permissions of any recovered files.

7.5 Scanning Preferences

Keep bad files will keep all found files to be displayed in the scan results, even if they appear to have
bad contents or format.

Maximum files/folders preference is used during scanning when Data Rescue has to create its own
folders using catalog files, such as the Orphans Folder within the Found Files results. When the number
of files would exceed the value set in this preference, Data Rescue will create a new folder. The default
is 1000 files per folder.

Data Rescue 3 Users Guide 47

8 Expert Features

The expert features are designed for technicians or experienced computer users to help recover data in
more complex recovery scenarios. Enabling expert features from the Preferences will display two new
available options: an Expert tab within Preferences and an Expert drop-down menu in the tool bar.

8.1 Expert Preferences

The Expert Preferences provide management settings for Data Rescue's file modules. The Expert
Preferences are separated into two additional tabs, Manage File Modules and Manage Conflicting File
Modules.

Manage File Module Definition Files will list any file modules added into Data Rescue by File IQ
and allows you to enable, import or remove file modules. This tab is primarily used to import
customized file modules passed from technical support in special case scenarios.

Manage Conflicting File Modules will list any file modules that have file patterns in common. Some
file types may be mistaken for use with another program or another version of the program. Clicking on
a listed file module will display any other file modules that were detected to have a similar file pattern.
You may select a different file module to replace the current active file module to help ensure the file is
found properly by Data Rescue.

8.2 Expert Menu

The Expert menu is available on the menubar at the top of the screen.

8.2.1 Allocation Blocks Layout

Allocation Blocks Layout can be used after a Deep scan if the files listed by the Found Files results
are not opening properly after recovery. If none of the files open when they are first recovered,
selecting this feature will provide you with additional options which may correct the way the files are
found.

During its scan, Data Rescue determines some possibilities for the proper Allocation Block Layout
setup. The Block Size is the number of bytes of the allocation block. The Offset is the number of bytes
(represented in hexadecimal), from the start of the media to the start of the file system.

The first choice is the default selection that Data Rescue considered to provide the best results, but if
the files are not recovered properly, try each of the other selections.

► ► To find the best allocation block layout for recovering files:

1. Complete a Deep scan on the hard drive.

2. At the results window, select a basic file (such as a JPEG image or text document) from the
Found Files folder.

3. Click on Preview to view the file.

4. If the file preview does not properly show the file, go to the Expert menu and click on
Allocation Block Layout.

5. Click on the next available selection inside the Allocation Block Layout window.

Data Rescue 3 Users Guide 48

6. Click on the results window.

7. Select the same file and click on Preview to view the file. If the file opens correctly, try
previewing a few other files to ensure they are viewed properly also. If multiple files begin
opening correctly, this is a good indication the right Allocation Block Layout was selected. The
files can be selected and recovered at this point.

8. If the files do not open in the Preview window, repeat steps 5 through 7 until the file is opened
properly in Preview.

In some cases, such as a drive you scanned had more than one partition or if there are remnants of older
file systems still present on the disk, you will find that some files require one Allocation Block Layout
selection and other files will require a different selection.

8.2.2 Choose Drive/Volume for Scan

Choose Drive/Volume for Scan allows you to reselect the source hard drive or volume for any
previous scan results in case the original hard drive or volume was renamed or detected incorrectly.
Selecting this feature will provide you with a list of connected hard drives or volumes to reference as
the source, as shown in Figure 26.

Figure 26: Choose Drive/Volume Window

If the correct hard drive is already detected, it will be listed by itself in the window. However, if more
than one volume is displayed, Data Rescue will compare the scan results to the selected media to detect
the correct scanned media. A description below the list will state any potential issues if the wrong
media is selected. The selected media which shows the least number of mismatched checksums and
does not display any significant errors will be the ideal original source media.

Data Rescue 3 Users Guide 49

► ► To reselect the drive/volume for scan:

1. At “Step 3: Find and Select Files”, highlight the scan results you want to reload.

2. Select Choose Drive/Volume for Scan.

3. Select the drive/volume that closely represents the original media scanned. Ensure the
description has the least number of mismatched checksums.

4. Click OK.

Once the correct media is selected, you may continue with your recovery process from the results.

8.2.3 Show Details

Show Details gives a simple count of the number of potential file starting points found during a scan,
organized by file type. The potential file starting points are not yet validated, so the ultimate number of
files found by the end of the process will be less (sometimes dramatically less) than the number shown
in the details window during the scan. The purpose of this window is to give the user an estimate of
what kinds of files are being found during the scan.

8.2.4 Block Level Tools

Data Rescue features block-level tools to display raw disk blocks. Most users will not need this feature,
but advanced users can use the block level tools to view absolute drive locations, such as viewing the
partition table at the beginning of a drive or viewing the data at the start of a file.

► ► To display a file's block data:

1. Highlight a file in the results window.

2. Select New window with this File's Data/RSRC.

The Logical block read depends on the allocation blocks layout. If the displayed data appears incorrect,
try a different allocation block layout. The Allocation Block Layout window automatically updates any
open block display windows, so you can immediately see the effect of choosing a different Allocation
Block Layout.

The standard block window shows only the start of the file that was highlighted when you open it. You
can open a special “inspector” version of the block window by holding down the Option key while
selecting New window with this File's Data. When opened in this way, the block display window will
show the all block information for the selected file. This allows you to quickly look at the the different
blocks of data for the file. If the displayed data appears incorrect, try one of the other Allocation Block
Layout choices as described in the previous section.

New Window with Block # will display data at a specific block number on the hard drive.

► ► To display a block number's data:

1. Select New Window with Block #.

2. Enter the block number to view.

3. A window will appear with the block's data. Click on Next or Previous to proceed viewing the
next block's data.

Data Rescue 3 Users Guide 50

8.2.5 Refresh Volume List

Refresh Volume List will rescan for any locally attached hard drives. By default, Data Rescue will
automatically detect any hard drives connected to the computer. This option may be used in case a hard
drive is not detected.

8.2.6 Add File to Scan

Add File to Scan allows a file to be added to the Source list and enables the file to be scanned for any
additional data that is a part of the file. This feature is especially helpful to help recover from damaged
disk images that fail to mount.

► ► To add a file to scan:

1. At “Step 1: Select Drive or Volume”, select Add File to Scan.

2. Browse the Open window and highlight the file you want to scan.

3. Click on Open to add the file to the Source list.

Once the file has been added to the Source list, you may proceed with the standard steps to scan the
file.

8.2.7 Set Drive/Volume Parameters

Set Drive/Volume Parameters is a feature that allows you to specify a starting and ending location
and file system type for scanning. Using this feature manually sets parameters for the selected media.
This is helpful if a hard drive's partition table was erased or damaged, but the file system and block size
are known to simulate the original partition. The Set Drive/Volume Parameters window is shown in
Figure 27.

Figure 27: Set Drive/Volume Parameters

Manually setting the hard drive / volume parameters requires technical knowledge of the media's
original settings to effectively utilize this feature.

There are several parameters that must be entered and selected:

• Scan Start Block / Byte # is the first column of values that specifies the start point of the media
where Data Rescue will begin its process. You may enter a value into either the Block # or Byte
# field, which will then automatically fill in the other field with its respective value.

• Scan End / Length allows you to choose whether you are scanning to a specific address (End),
or to scan a specific number of blocks/bytes (Length). Choose End if you know the ending
address of the specific partition. Choose Length if you know the size of the partition.

• Scan End Block / Byte # is the second column of values that specifies the ending address or

Data Rescue 3 Users Guide 51

length of scan depending on what selection you have made from the drop down menu. You may
adjust the value in either the Block # or Byte # field, which will then automatically fill in the
other field with its respective value.

• File system allows you to specify what file system to detect within the block / byte range. You
will want to select the original file system that was used on the partition.

• Display format allows you to choose the displaying values for the block and byte files to
Hexadecimal or Decimal format.

• The Revert Button will reset the values to the default information based on the media's original
settings.

► ► To manually set the drive / volume parameters:

1. At “Step 1: Select Drive or Volume”, highlight the hard drive or volume for which you want to
change the parameters.

2. Select Set Drive / Volume parameters.

3. Enter the Start Scan Block / Byte #.

4. Select End or Length from the drop down menu.

5. Enter the Scan End Block / Byte #.

6. Select the File system from the drop down menu.

7. Click on Set to apply the settings.

Once the parameters have been set, you may proceed with the standard steps to scan your hard drive.

8.2.8 Add RAID Set

Add RAID Set allows you to simulate a RAID configuration based on the RAID functionality built
into Mac OS X. This is helpful in case an Apple RAID configuration fails to mount or be recognized as
a single volume. Please note that Add RAID Set does not attempt to fix or repair a RAID set. Instead,
the RAID set is configured through Data Rescue for the purpose of scanning for data. The Add RAID
Set selection window is shown in Figure 28.

Data Rescue 3 Users Guide 52

Figure 28: Add RAID Set

Add RAID Set will not write any data to the hard drive, keeping the original state of the hard drives.
This feature is specifically intended to help simulate Apple software RAID configurations. Data Rescue
3 attempts to setup the RAID settings based on what it detects on the drives, so it may not be necessary
to alter any settings when adding a RAID set.

► ► To add a RAID set:

1. At “Step 1: Select Drive or Volume”, hold the ⌘-key while clicking on the hard drives in the
list that are associated with the RAID volume. This will highlight multiple hard drives.

2. Select Add RAID Set. This selection will be active only if two or more hard drives are
highlighted.

3. In the Add RAID Set list, drag the items in the list to rearrange the order of the hard drives /
volumes from first to last. Data Rescue will automatically configure the order of the drives, and
set the stripe size and RAID type according to what it sees on the drives. Only manually change
the order, RAID type and stripe size if you know them to be incorrect, or have tried a scan with
them using Data Rescue's determined configuration and it didn't work.

4. Select the RAID type and RAID Stripe Size. If you are not using a Striped RAID, leave the
Stripe Size as 32KB.

5. Click on Continue to add the RAID set.

6. A new selection in the Source list will appear as “RAID SET”.

Once the RAID set has been added, it can be selected to scan for data. In some cases, data may not be
opened properly when recovered if the hard drives are not arranged in the correct order.

Data Rescue 3 Users Guide 53

If data is not being recovered properly from the RAID, we suggest the following steps to troubleshoot
the issue:

• Adjust the allocation block layout and reattempt the recovery until all options are exhausted or
files are recovered.

• Redefine the RAID Set by using Add RAID Set, and drag to rearrange the order of the hard
drives / volumes. Data Rescue does not currently support editing an existing RAID set. To
change the configuration, you must define a new RAID Set using the different parameters.

Data Rescue 3 supports 3 basic types of RAID, described very briefly below.

Stripe – This is also known as RAID-0. As data is read sequentially from the RAID set, it comes first
from the first component drive until a stripe-sized amount has been read, then the next data comes from
the second component drive, and so on, in round-robin fashion.

Mirror – This is also known as RAID-1. With this scheme, each of the drives is suppose to contain the
exact same copy of data. This means that if you have an undamaged component drive, you should be
able to just scan that to find your files (you will not need to create a RAID set).

Concatenated – This is not an official RAID level, but rather a way to make multiple hard drives
appear as one big drive by concatenating them together. As data is read sequentially from the RAID set,
it comes first from the first component drive, until the end of that drive is reached, then continues
coming from the second component drive, and so on until the end of the last component drive.

The ordering of the component drives is mainly important for stripe and concatenated types. If this is
wrong, the scan may find few or no good files. To alter the order, simply drag each drive in the list into
its proper position.

This RAID Stripe Size relevant for the Stripe RAID type, but irrelevant for the other types. The
default and most common value is 32KB.

8.2.9 Node Inspector

Node Inspector will display technical information about a selected file from the scan results list, as
shown in Figure 29. This feature is intended to aid resolution of field problems by Prosoft Technical
Support.

Data Rescue 3 Users Guide 54

Figure 29: Node Inspector Window

This information may help cross reference the results that are listed between Found File results and
Reconstructed File results. The first address of hex information will be displayed towards the bottom of
the window to help immediately identify the file header of the file. While the Node Inspector is
displayed, clicking on files within the results list will update the information in the Node inspector to
quickly view general information about the file.

The Pin checkbox allows you to lock the information inside the window. A new inspector window may
be opened to compare the data between the two windows. This may be helpful for a technician to
compare files for similarities or file patterns in file headers.

Data Rescue 3 Users Guide 55

9 Concepts

The next sections are for users wanting a more detailed understanding of Data Rescue's options, or who
were unable to recover files they wanted using section 4's basic instructions. This section explains some
concepts needed to understand how to set the Data Rescue options not covered earlier and how to use
Data Rescue to its fullest. The next section goes through specific options, what they do and why you
might use them.

9.1 Selecting a Volume or Drive to Scan

As used in this document, the term “drive” refers to a whole device, for example an IDE or Firewire
disk drive. A “volume” is a logical part of a drive. A drive may be partitioned into multiple volumes, or
it may contain only one volume – this is determined when the drive was originally configured. Figure
30 displays the storage space available on two disk drives. The first drive has most of its space
allocated into a single volume. The second has most of its space split between two volumes.

Figure 30: Drives vs. Volumes

Each volume resides in a partition of the drive. Stored within a volume are the volume's name and all
its files, folders and catalog structures. The files and folders on a volume are all defined relative to the
beginning of that volume on the drive.

In normal Macintosh operation, the user will see on his desktop an icon for each volume, labeled with
the volume's name. These are names that may be specified or changed by the user; like “Macintosh
HD”, or “My Backup Disk”, etc. The drive itself also has a name, defined by the manufacturer; names
like “IBM-DTLA-307045 Media”, “DMI MAXTOR 6Y060L0 Media”, etc. In normal Macintosh use,
the user does not see the drive names – only the volume names. However, you may see both when you
use Data Rescue, so you will need to be aware of them.

When Data Rescue starts, it makes a list of drive and/or volume names. These are displayed in one of
two ways, depending on whether you have selected the Arena View or the Detail View. The following
figures show the two views.

Data Rescue 3 Users Guide 56

Figure 31: Drive / Volume Selection

The first drive has a hardware drive name of “miniXpress825” which has a single volume on it named
“Sample Files”. The second drive “ST316081 3AS” is divided into two volumes, with names “My
Photos Disk” and “Laptop Backup”.

When a scan is done, Data Rescue uses your selection to determine which area of the drive to scan. The
selected scanned area must include the volume which contains the files of interest, otherwise there is no
chance they will be found.

Data Rescue 3 Users Guide 57

It is also important to avoid scanning areas of the drive which are known to not contain files of
interest. Scanning unnecessary areas of the hard drive will increase the number of spurious results and
may confuse the Allocation Block Layout calculations, which can result in problems during the
recovery.

Ideally when you scan, you want to choose the volume which contains files of interest, not the drive.
The exceptions to this rule come about when the volume either does not appear in Data Rescue, or it
does appear but you know or suspect that there is something wrong with its size or location. These
cases can be caused by drive corruption, or accidentally repartitioning a drive. If the volume of interest
doesn't appear, or its position or size suspect, then the drive should be chosen.

If the drive in question is known to contain only a single volume which occupies most of the drive
space, then either the drive or volume may be selected since either selection defines nearly the same
area on the drive. If the drive is known to contain more than one volume (even if only one is visible),
then only the volume with the missing files or issues should be chosen. If a multi-volumed drive is
chosen, the results will most likely not be satisfactory.

If the volume of interest does not appear, then you will have to select the drive, but you can still set
Data Rescue to scan a particular area on a drive. That may be done using the Set Drive/Volume
Parameters feature available through Expert Mode (see Section 8.2.7 for more information). With this,
you can manually specify the start and length of an area of the drive to scan.

The Quick and Deleted scans must occur on a single volume, otherwise they will fail to find any files.
As a convenience to the user, if a drive is chosen for either of these scans, Data Rescue will look for the
first volume on the drive, and perform the scan on that volume if it is found.

9.2 File Systems and Catalogs

Each disk volume is formatted with a file system. Examples of file system formats include HFS, HFS+,
FAT16, FAT32, NTFS, UFS, etc. Macintosh computers are typically formatted as HFS+. Windows PC s
typically use FAT32 or NTFS. The details of these formats are considerably different, but have some
things in common: they both support file and folder (directory) objects and they all have some form of
bookkeeping information, which we will call “catalog” information. Figure 32 shows part of a
simplified generic file system to help illustrate the concepts.

Data Rescue 3 Users Guide 58

Figure 32: File System Data Storage and Catalog Structures

Files are used to store the content, such as the bytes making up an image, song, etc. Each file has its
own format (JPEG, MP3, etc.) which is independent of the file system format. Folders (directories) are
special files which are used to organize files and other folders into a logical hierarchy called a
“directory structure”. The catalog information keeps track of the files and folders, what their names are,
and where they are stored within the volume.

Figure 32 illustrates a file system with two files named “fud” and “dud”. Each file has a catalog
structure. A catalog structure stores all the information about the file except the data itself, which for
file “fud” is stored in 3 consecutive allocation blocks numbered 3, 4, and 5. The operating system uses
the information in the catalog structure to get the location of the file's allocation blocks on the media
(the disk). Other catalog structures are in turn used to get the location of those catalog structures, etc. It
all forms a big branching tree-like structure. At the base is a special catalog structure called the catalog
root, which the operating system normally knows how to find directly. From the catalog root, all the
other catalog structures, and file allocation blocks can be found by the OS.

Data Rescue 3 Users Guide 59

Figure 32 also shows another file “dud” which is similar to file “fud”. “dud” also has its data stored in
3 allocation blocks, but the blocks are not consecutive. The first 2/3 of “dud's” data are stored in blocks
11 and 12, but the last part is stored in allocation block 7. File dud is therefore not stored consecutively
and in order, and is said to be fragmented. Since the location and ordering of the blocks is maintained
in dud's catalog structure, the operating system is able to use this to maintain the illusion of continuity,
making it appear to applications as though dud's data were all in one continuous piece.
With the preceding discussion as background, we are now in a better position to explain the Data
Rescue 3 scan types. For those who are familiar with Data Rescue II, the scan types for Data Rescue 3
are the same, except that Data Rescue II's “Thorough Scan” has been renamed to “Deep Scan” for Data
Rescue 3.

Data Rescue 3 supports three user-selectable scan types: Quick, Deleted, and Deep. These three scan
types are actually combinations of two fundamental conceptual scan types “catalog” and “content”,
described below. The Quick scan is basically a catalog scan. The Deep scan is a combination of a
catalog and content scan. The Deleted scan is a content scan, but with information from the catalog to
define the free space areas.

9.3 Catalog Scans

A catalog scan looks for and relies on catalog structures to find files. To the extent that the files and
directory structures are still referenced by undamaged portions of the catalog information that is found,
these files along with their original names and directories can be recovered. File recovery using a
catalog scan is independent of the file type or format; files of all types are equally well recovered by
catalog scans.

There are two types of catalog scans supported in Data Rescue: Quick and Deep. The Quick Catalog
scan traverses the catalog tree much the same as the operating system would, and will find files and
folders that are part of the catalog tree. The Deep Catalog scan does not rely on the higher level catalog
tree structures. Instead, it searches the media directly for catalog structures that point to files and
folders.

The Deep scan is generally more useful, because it can find catalog structures that are not referenced by
a (possibly damaged) catalog tree. (Furthermore, the Deep scan incorporates a Content scan, discussed
in Section 9.4). The Quick catalog scan assumes that the most important catalog structures are valid
and intact, and only looks for catalog information in the places they are supposed to be. For this reason,
the Quick catalog scan is often not very useful for recovering files on file systems that have substantial
damage. However, there are cases in which the operating system cannot see the files, but the Quick
catalog scan can find them. Since the Quick Catalog scan is very fast compared to the Deep catalog
scan, it doesn't hurt to try the Quick scan first. If it does not find the files you wanted, proceed with a
Deep scan.

The catalog scans will only be effective for file system formats which Data Rescue understands.
Currently this includes HFS and HFS+ file systems, though other types may be added in the future.

Data Rescue 3 Users Guide 60

9.4 Content Scan

The Content Scan (included in the Deep and Deleted scan) does not depend on any catalog structures,
but instead searches the media directly for the file data. It does this by recognizing the format of the
file's contents. As part of the Deep scan, the Content scan checks the entire volume or drive. Since the
Content scan searches for the file contents directly rather than the catalog structures, the Content scan
cannot generally recover a file's name or folder (directory). On the other hand it is able to recover file
data that is no longer referenced by any catalog structure, which catalog scans cannot do by themselves.

A Content scan can only recover files whose format is recognized and supported by Data Rescue.
Currently this list includes the following file types, but more are added with updates of Data Rescue.
For a more up to date list, refer to the Release Notes which came with your Data Rescue 3 distribution.
In addition to these types which are automatically included, Data Rescue 3 has a new File IQ feature
which allows new file types to be added based on user-supplied sample files. See Section 5.6 for more
information about File IQ. Supported file types include:

Images: General JPEG, TIFF, PNG, GIF images

Adobe Illustrator AI, EPS
RAW Camera Formats CRW, CR2, NEF, DCR, ORF
Photoshop JPEG, TIFF, PSD, BMP, PCS, EPS
CaptureOne TIFF, RAW
FreeHand EPS, Print Shop, MacDraft, MacDraw, MacPaint

Movies: Quicktime MOV, MPEG-1, AVI, WMV, Flash SFW

Final Cut Projects, Raw DV, Cinema 4D, After Effects

Audio: General WAV, MP3, AIFF, AAC/M4A/M4P/M4B

Logic LSO, Finale Project, Maya Session, ProTools Session
Reason Session/Refill/Published/Recycle

Mail: Eudora, AppleMail, Outlook Express, Entourage

Documents: PDF, Word DOC, PowerPoint PPT, Excel XLS, Quark EPS

AppleWorks, ClarisWorks, OpenOffice, Quicken, QuickBooks, FreeHand
AutoCAD, EndNote, FinalDraft, InDesign, VectorWorks, iWork 09

Text: Generic ASCII Text TXT, RTF, XML, PLIST, HTML, Postscript (non-binary)

Misc: Retrospect, GZ, ZIP, Stuffit, DMG, resource forks

Only non-fragmented files (i.e. those which are stored sequentially on consecutive disk blocks) can be
successfully recovered with the Content Scan. (Catalog scans have no such limitation). Fortunately,
many file systems including HFS/HFS+, FAT, NTFS store most of their files in a non-fragmented
manner.

Data Rescue 3 Users Guide 61

9.5 Deleted Files Scan

A Deleted Files scan is similar to a Deep scan for a volume, except that only the free space of the
volume is searched. Since there are no catalog entries for deleted files, this search does not look for
them. Only a content scan is done for the free space. As a result, all files found with this method are
found by the content scan method as explained in the previous section, only the file contents will be
available.

The original filename and folder information is not generally available, so file contents are given a
generated name and folder by file type. The files found by this type of scan will be a much smaller
subset of files found by the Deep scan. One of the advantages of a Deleted File scan is that there will be
many fewer results to filter through compared to the Deep scan to find specifically files that were
deleted. Since the free space will often be only a fraction of the total volume space, the search time will
be only a fraction of the Deep scan.

The Deleted File scan is only suitable for volumes which are in good shape or undamaged since the
scan depends on an accurate map of free space on the volume. If the volume is damaged, you will most
likely have to use a Deep scan to search for files.

9.6 Scan File

Regardless of the scan method chosen, as Data Rescue scans your media, it builds an internal list of
information about files and folders it has found. When a scan is completed, this information resides
within the Data Rescue workspace until it is deleted. However, it may be saved for longer term storage
as a compressed file called a “scan file”. This is available in the Manage Scans and Workspace
dialog, where you may save one or more scans to a scan file as shown in Figure 33.

Figure 33: Saving Scan File

Data Rescue 3 Users Guide 62

In this way, the results of a lengthy scan can be saved, then loaded later without having to repeat the
scan. Data Rescue 3 scan files are not compatible with previous versions of Data Rescue.

The scan file only saves indexes to the files found on the scanned drive, not the file data itself. To
recover files later using the scan file, you will need to retain the scanned drive in its unmodified state.

To utilize a previously saved scan file, select the Import popup option of the Manage Scans and
Workspace dialog, as shown in Figure 34.

Figure 34: Importing Previous Scan files

Since a scan file represents a snapshot of information collected from a volume in a particular state, it
should be clear that if the volume is allowed to change (for example if the volume has new data written
to it) following the saving of the scan file, the scan file will be stale with respect to the volume, and
will no longer accurately represent its contents. The more writing done to the drive after the scan file
has been saved, the more inaccurate the loaded scan file results will be.

Data Rescue 3 Users Guide 63

9.7 Allocation Blocks and Media Blocks

This section will explain media blocks and allocation blocks, how they relate to each other and why
their relationship is important. This information is helpful if Data Rescue has trouble determining the
proper relationship between the media blocks and allocation blocks.

We use “media” as a generic term to mean any type of device that holds volumes with files and folders.
Digital media is usually divided into fixed sized chunks which we will call Media Blocks, or MB for
short. (An MB is typically 512 bytes, but the size is not important for this discussion). Figure 35
illustrates the media broken into a string of consecutively numbered MBs, starting at 0 at the beginning
of the device, all the way to the end. Data for a file always starts at the beginning of an MB, so the start
of any file may be accessed by its MB number (MB#). The software that talks directly to the storage
device does so using the MB numbers.

Figure 35: Media and Allocation Blocks

As discussed earlier in Section 9.1 for Selecting a Volume or Drive to Scan, Figure 35 explains that a
file's data is broken into allocation blocks which are stored in a volume. We call these “allocation
blocks” (Abs for short) because whenever the operating system needs to allocate space for a file in the
volume, it always allocates a whole number of these blocks. Figure 35 illustrates how an example
volume might lay out on the media. Allocation blocks are always a fixed whole number of MBs.
Volumes always consist of a whole number of Abs. In this example, there are 4MBs to every AB, and
the volume starts at MB#2. The distance from the start of the media and the start of the volume is
called the “offset”, and it is not necessarily a multiple of the AB size. The example illustrates one file
“spud”. Files always start at the beginning of an AB. In this case, spud starts at MB#6 and AB#1.

The catalog structures (discussed earlier) contain a list of AB numbers making up a file's data.
Therefore, the catalog structure for spud would contain “1” as the starting location of spud, because it
starts at AB#1 relative to the start of the volume.

In order for the operating system software to read the first part of the data from spud, it must ask for the
storage device for MB#6, because that is where spud starts in terms of MB numbers. Therefore, the
AB# in the catalog structure must be translated into an MB# in order to access the data. To do this, you
need to know two numbers:

• What is the offset?

• What is the size of an AB in terms of MBs?

Data Rescue 3 Users Guide 64

You can see that for our example, offset = 2 because the volume starts at MB#2, and the size = 4,
because each AB is comprised of 4MBs. The formula to do the translation in general is quite simple:

MB# = AB# x size + offset

These two important numbers, size and offset, are together referred to as the “allocation block layout”
(ABL for short).

Normally the ABL numbers for a volume are stored in a known location so the operating system can
find them. For HFS and HFS+ file systems, they are stored in volume header structure called
MDB/VH. For HFS+ system, a copy of this structure is also stored, called the Alternate MDB/VH.

The significance of the ABL numbers should now be obvious – if a Data Rescue Scan has found a
catalog structure for a file, it will still need to know the proper ABL numbers in order to read the data
from the media when recovering the file. In the previous example, if the offset were accidentally
changed to 1 rather than 2, when you tried recovering spud, the starting point would be calculated as
MB#5 rather than MB#6, which might be part of some other file or be random data. In fact, the wrong
ABL would mean that every file on the volume would be read and recovered incorrectly.

9.8 Locating your file after a Scan, Revisited

Files located by their content (i.e. those listed under the Reconstructed folder) have several significant
differences from those found by catalog scan, which the user should understand. This section endeavors
to explain those differences and the recommended way to deal with them. We will use the following
abbreviations for this section:

catalog-file: a file found by Data Rescue using a Catalog scan

content-file: a file found by Data Rescue using a Content scan

9.8.1 Locating a file found by a Catalog Scan

A catalog-file will usually (but not always) show up in the recovery window with its original filename,
and in its proper place in the directory structure tree (the one under Found Files). In this case, the user
may locate the file in the recovery window by navigating through the directory structure to the place
where he remembers the file to have been, or by searching for the file by name.

In some cases, a catalog-file's folder will be unknown. In this can happen for example, if the catalog
information for the file's directory is invalid. In these cases, Data Rescue synthesizes a new folder
name, and puts it in a folder named “Orphans Folder”. If you have done a scan and haven’t found a file
you are looking for in the normal directory structure, and an Orphan Folder is present, it is possible that
your missing file might be among those orphans. It is also possible in some cases that the file’s original
name may have been changed to something else, such as “inode123456” by the operating system.
These cases too may end up in the Orphans Folder. The recommended way to deal with these “inode”
files is to recover them all, then use the Finder to see their type. If one has a type matching the type you
are looking for, you can try to open it with your application to see if it is the one you want or not.

Data Rescue 3 Users Guide 65

9.8.2 Locating a file found by Content Scan

As stated earlier, a Content scan finds only the file contents, not its name or folder. Therefore, content­files usually have a synthesized name and folder. One thing that is known about the content-file is its
type, and this type is used to generate a meaningful filename extension for the synthesized filename. In
addition, files of the same type are grouped together in a synthesized directory named for that type. So
for example, MP3 files found by a Content scan will be found in an MP3 subfolder, and the filename
will be something like “M123.mp3”. In some cases, it is possible for Data Rescue to extract some
additional information from the file contents to make the synthesized filename more meaningful. For
example, a JPEG content-file will have a name like “J1200x768-123.jpg”. This not only identifies it as
a JPEG file with the .jpg extension, but includes the pixel dimensions of the image (1200 by 768) as
part of the name.

Data Rescue 3 includes a Preview capability which may be used to preview many file types prior to
recovery. The previewer is not able to handle all types however, so if it is not able to handle preview of
one of your types of interest, the recommended procedure is to go ahead and recover the types of
interest, then use the Finder to browse and preview them. Alternatively, you may double-click a file in
the file browser, which will automatically recover that file and ask the system to open it with the
appropriate application. Note: Double-click opening is not available in Demo mode or when booted
from the DVD.

Data Rescue cannot properly recover fragmented files by content. A fragmented content-file may
appear like any other content-file in the recovery window, but upon recovering and trying to use it, you
may discover that the contents are truncated, or contain unrelated garbage part way through the file,
that the file won’t open (if the application is particular), or in rare cases that the application will crash
or the Finder will restart when you attempt to open or preview that file. In that case, you should just go
ahead and delete that recovered file, since it isn’t any good anyway.

Data Rescue 3 Users Guide 66

10 Troubleshooting and Frequently Asked Questions

The following chapter contains some commonly asked troubleshooting questions and their solutions or
workarounds. If problems still persist, contact Prosoft Engineering Technical Support via our website at

http://www.prosofteng.com.

10.1 Data Rescue seems to freeze. What should I do?

Most cases of apparent freezing are actually slow reads due to disk problems. If Data Rescue runs into
a disk area where the disk is having trouble reading, it may appear to freeze, but actually just be very
slow. If you think it has frozen, make a note of what is being displayed on the progress display, for
example, the block number, then check again in half an hour or so and see if it has advanced at all. If it
progresses, it is probably just slow due to disk read problems. If you continue having difficulties, make
sure cables connecting to the disk drives are properly seated and consider disconnecting or turning off
any unnecessary devices connected to the computer.

10.2 Why doesn't my drive or volume show up?

If you have attached a drive with a damaged volume since you started Data Rescue, Data Rescue may
not automatically notice it. Try the Expert  Refresh Volume List menu item. If the volume you are
looking for still does not appear, it may be because Data Rescue is unable to find the correct name for
it, in which case it may show some other name such as “unknown” for the volume name. Or it may be
that Data Rescue can see the device, but is not able to recognize a volume structure on the device. If
that is the case, you will need to choose the device name for scanning rather than the volume.

Finally, it could be possible that your drive is malfunctioning to the point where your computer is not
able to talk to it at all, in which case even the device name will not appear. In this case, Data Rescue
will not be able to scan your device. In this latter case, you might try some or all of the following things
to see if your device can be made to appear: Double-check the drive cables and power source;
remove/reattach the drive and/or power cycle it; power down and restart your computer. You can also
double check that the problem isn’t with the Data Rescue software itself by looking for your
volume/drive using Apple’s Disk Utility. If Disk Utility can see it, Data Rescue should be able to also;
if Disk Utility can’t, then Data Rescue won’t be able to either.

10.3 Why are some files listed twice?

Sometimes, your volume contains obsolete catalog entries. If Data Rescue finds two catalog entries
with identical names, it first checks if the two entries refer to the same data. If so, then the items are
called “true duplicates”, and only one of these will be retained, and the other automatically removed. If
the two entries refer to different data, both of them are retained, even if they have identical names and
appear to be in the same directory, because there is no way to know which one is the correct one. To
find which is the correct entry, check dates and file contents.

Data Rescue 3 Users Guide 67

10.4 Why do my found files total more than the size of the original drive?

There could be two reasons for this, as explained below.

When you do a Deep scan, Data Rescue uses two different algorithms to locate files. (See the
explanations of catalog and content scans in Section 9.3 and 9.4.) These methods will often locate
many of the same files twice – once under the Found Files folder and again under the Reconstructed
Files folder. (Data Rescue does not currently have the capability to automatically cross correlate these
sets of files, but may do so in a future version.) So if you elect to recover everything, it will often be the
case that the total space required exceeds the original media size.

The second reason why the found files may total more than expected is the possibility of anomalously
(and incorrectly) large files. In the course of scanning the media, Data Rescue will often come across
bad files and catalog entries. Data Rescue is able to filter out the vast majority of these bad entries, but
not all of them. Occasionally a few of these may show up in the recovery list with incorrect and large
sizes. If you suspect this may be the case, you can easily find these large files by searching for files
greater than a certain size using the Edit  Find menu item. A useful technique to eliminate these from
the recovery is: first mark everything by clicking the checkbox for the top level folders, then search for
and uncheck the large files which appear to be bogus.

10.5 Why is there a delay when I click the mark checkboxes?

After scanning a large drive, there may be hundreds of thousands or millions of files and folders to deal
with. When you click on a mark checkbox in the recovery list to mark or unmark files for recovery,
especially the top-level folders, Data Rescue has to walk recursively down through most of these items
to individually mark or unmark them. The time this takes is proportional to the number of found files.

10.6 Does Data Rescue handle RAID volumes?

With RAID, several component drives are set up to act logically as if they were a single composite
drive. If your RAID drives or file system is in good enough shape that the system can still make them
appear as a single logical drive, then Data Rescue should be able to scan that composite drive and
recover files from it.

If the situation is such that the system cannot present the component drives as a single composite drive,
then the answer depends on what kind of RAID your drives are set up to do. If the drives are set up to
do mirroring (i.e. each file is stored completely on each mirror drive), then Data Rescue should be able
to a Deep scan any of these component drives and recover files.

If the RAID is configured using Apple's software RAID system, you may enable Expert features and
use the Add RAID Set feature to help simulate and scan the RAID. See Section 8.2.8 for more
information using Add RAID Set. If the composite RAID device is visible without adding a RAID Set,
it is almost always better to scan that than to create a RAID Set and scan it.

Data Rescue 3 Users Guide 68

10.7 I recovered files, but they won’t open. What’s wrong?

The answer to this question depends on whether you’re talking about files recovered from
under the Reconstructed Files or Found Files Folder.

Files recovered by catalog (i.e. from the Found Files folder)

It’s normal for a small percentage of recovered catalog files to be bad. But if you have checked a
number of them and none of them are good, then chances are that they were recovered with the wrong
Allocation Block Layout setting. Pick out a few files to use as test files, and go back and select a
different Allocation Block Layout choice as described in Section 8.2.1 and recover a few files. If you
find an ABL setting that gives good results on those files, re-do your big recovery with that setting. For
more information, read the material on Allocation Block Layout in Sections 8.2.1 and 9.7.

Files recovered by content (i.e. from the Reconstructed Files folder)

It’s also normal for a small percentage of these files to be bad. If the original file was fragmented (not
stored on disk in consecutive blocks), then it can not be properly recovered by content. In most normal
situations, most files on a user’s disk will not be fragmented. Typical fragmentation rates for files tend
to be just a few percent. Note: The ABL setting plays no role in recovering files under the
Reconstructed Files folder.

10.8 Can I recover files that I deleted accidentally?

In OS X, when a file is deleted, for example by dragging it to the trash and emptying the trash, the file’s
name and folder information is usually erased by the system, and is therefore irretrievably lost.
However in most cases, the most important part of the file – its contents – are still present on the disk.
Finding the file by its contents alone is in general a difficult task, requiring algorithms to recognize
those contents among all the billions of bytes of data on the disk. The Deleted File scan will list over
150 major file types it detects based on its file patterns. See Section 5.3 for more information using the
Deleted File scan.

10.9 What are Data Rescue's general content scan capabilities?

In generic technical terms, Data Rescue’s content scan is potentially suitable for any file type that
consists of a single fork. For files that have both a data and a resource fork, the forks may be
recoverable separately by content scan, but Data Rescue has no means to connect the two pieces back
together. Some “files” are in reality a collection of separate files which the Finder treats like a single
file. This is called a “bundle”. The individual components of a bundle may be recoverable by content
scan, but again Data Rescue has no automated way to associate these components back together into a
bundle.

An additional requirement for a successful recovery by content is that the file’s data not be fragmented.
In other words, it must be stored from beginning to end in consecutive media locations. Fortunately,
most files get stored on disk that way. OS X tries to store files in a non-fragmented way when it can.
Still it is typical for a small percentage of files to be fragmented, and these will not recover properly
when found by content.

Data Rescue 3 Users Guide 69

Important: Do not mistakenly use a defragmentation utility (or any other program which will alter
your disk) after losing your files, and prior to scanning with Data Rescue. Doing so will only make it
less likely that you will be able recover your files.

Note: The above limitations apply only to the files found by content. For files that are found by their
catalog entries, the original bundles and forks may be properly recovered, and fragmentation is not an
issue.

10.10 Specifically what types of files can Data Rescue 3 find by content?

The actual list of file types recoverable by content can be seen from within Data Rescue by going to the
Data Rescue 3 Preferences menu and browsing through the File Modules tree. We expect to be adding
to this list on an ongoing basis. For a recent list of filetypes recoverable by content, see the Release
Notes file that came with your Data Rescue 3 distribution.

For any file types not supported by default, Data Rescue 3's File IQ feature will allow you to analyze
sample files and possibly generate a file module to help detect the files you are looking for. See Section

5.6 for more information with File IQ.

Data Rescue 3 Users Guide 70

11 Glossary

Allocation block: this is a block of file data within the file space of a volume. The size of allocation
blocks is the same within a volume, but different volumes can have different allocation block sizes.
This size is always a multiple of 512 bytes so allocation blocks boundaries are always aligned with
logical blocks.

Creator type: Associated with every file on a Macintosh is a four letter code that specifies the file’s
creator. The creator is typically the application that created the file to begin with. This code is hidden
from the user, but is used by the file system in a number of ways. For one, along with the File type, it
helps determine the icon to display for that file. In addition, when you double click on a document, it is
the application that has the same creator code as the document that will be launched to open that
document.

File type: Associated with every file on a Macintosh is a four letter code that specifies the type of file it
is (e.g. ‘TEXT’ denotes a text file, ‘APPL’ denotes an application). On many other operating systems,
the file type is part of the name; it is usually a three-letter code following a period (e.g. myfile.txt or
letter.doc). On the Mac, this code is hidden from the user but serves the same purpose: to identify the
kind of file. It uses the file type, along with the Creator type (see below) to determine the icon to
display for a given file.

HFS, HFS+: This stands for “Hierarchical File System” and “Hierarchical File System – Plus”. These
are the names of Apple’s proprietary File system layout for Mac OS computers. The newer, HFS+
system affords greater file and disk capacities, as well as performance improvements over that of the
older HFS architecture. HFS+ was released with Apple’s 8.1 operating system and is designed to
supersede HFS. All Mac OS versions from 8.1 Classic through OS X 10.x support both HFS and HFS+.

Orphan: An orphaned file or folder is a file or folder which Data Rescue has discovered a catalog
entry for, but no parent catalog folder can be found. Items like this are presented under the Orphans
Folder in the Data Rescue recovery window.

Physical block: this is a 512-byte block of information on a physical device. Physical blocks start at
zero so physical block #0 is usually the first block of the partition map of a physical device.

Remote volume: A remote volume is a volume that is not directly connected to your computer.
Typically a remote volume is a file server. If your Macintosh is not connected to a computer network
(e.g. at your company), you probably don’t have access to any remote volumes.

Data Rescue 3 Users Guide 71