Scanning for Files and Folders FAQs
Why does the preview window show "No Preview available for this file type"?
FileRestore for Networks uses LiveView™ image display handlers that enable it to provide preview thumbnails for many of the most common file types. In other instances it may display this preview message instead. There is also a specific version of this message, which may be displayed in cases where Excel (or Word) files have been written using older versions of Excel (or Word), or may be password protected. In all such cases, while it is not possible to show a preview of the file, it may still be possible to recover it.
Why does the preview window show "File Data may be Corrupted - Preview not available”?
This means that the file is unlikely to be able to be recovered as too much of its content has been destroyed. However the file condition should also be reviewed, i.e. Poor, Good or Excellent. In some instances a file may show the “File Data may be Corrupted” preview, but also show as having an excellent condition. In this instance, the file may still be available for partial or even, in some circumstances, full recovery.
Why does the Scan Progress bar sometimes include sector information and not at other times?
This depends on the file system and type of scan. For example, during a Complete Scan type, FileRestore for Networks reads the whole disk from end to end and so can display the sector information. During an Advanced Scan type on an NTFS drive though, it does not read the disk in this manner and therefore may not be able to display this information.
Why does the list of files show lots of files that I have never seen before?
It is likely that FileRestore for Networks will locate temporary files that are often created when a new file is created. You may also find image files that have been automatically saved to your computer whilst surfing the internet. If you are searching for particular image files you may find it helpful to switch to the Folder View display and examine the folders most likely to have contained your files originally. Most temporary and internet files (as mentioned) will be located in temporary folders with names you are unlikely to have chosen yourself.
I can’t see my lost filename but I can see other files with names such as Dc54. What are these files?
These are files that have been deleted or emptied from the Recycle bin.
Each hard disk contains a hidden folder named Recycled. This folder contains files deleted in Windows Explorer or My Computer, or in Windows based programs.
When you delete a file the complete path and file name is stored in a hidden file called Info or Info2 (Windows 98) in the Recycled folder. The deleted file is renamed using the following syntax:
D<original drive letter of file><#>.<original extension>
For example:
New file name: Dc1.txt = (C drive, second file deleted, a .txt file)
INFO file path: C:\Windows\Desktop\Books.txt
New file name: De7.doc = (E drive, eighth file deleted, a .doc file)
INFO file path: E:\Winword\Letter to Rosemary.doc
Each drive has a Recycled folder. Files deleted from programs are moved to the Recycled folder on the drive from which they are deleted.
Clicking a file and choosing “Restore” causes the original path to be read from the INFO file, and the file to be renamed and restored to its original path.
There is a folder named Lost. What is this folder?
Files and directory details are stored separately on a disk. On some file systems the file entry has a directory entry number associated with it, and on other file systems the directory entry holds a list of files it contains. In some instances, the two entries do not match up or the directory details may be incomplete or missing. In this case the files are located in the LOST directory.
There is a folder named Discovered. What is this folder?
A FileRestore for Networks Complete Scan includes exclusive File Discovery™ scanning technology. File Discovery™ will automatically scan a drive for traces of a file (file signatures), even in instances where the file name no longer exists. File traces may be scattered over the entire surface of the drive and are unlikely to be located using traditional data recovery methods. FileRestore for Networks “Discovered files” are renamed “Discovered” (as the file name no longer exists), and saved to a newly created folder called “Discovered”.
Why can’t I find files deleted or emptied from the Recycle bin?
These particular files may have been “renamed” by Windows when they became deleted. See FAQ ‘I can’t see my lost filename but I can see other files with names such as Dc54. What are these files?’
Why do some files have a 0 byte file length?
There are many scenarios where a file can display a 0 byte file length. The more common examples are: When Windows downloads a file from the Internet, it typically creates a temporary file to download the data to. Once completed it will copy the data to a new file in the correct download directory. When this is completed, it will truncate the temporary file and leave it as 0 bytes, and then delete it. This is done so that if the information that is in the temporary file is cached and hasn’t been written to disk, no disk space is used when the cache is emptied.
Another scenario where this may occur is when a file entry is moved from one directory to another. An empty “shell” of the file record will then remain in the source location until it’s overwritten.
How long should a scan take?
That depends on the type of scan, the device being scanned, its size, the number of files on the drive etc. The Fast Scan is the quickest and the Complete Scan is typically the longest. USB devices and memory cards can be much slower to scan than built in drives, as their read speeds tend to be slower. The scan progress bar provides a constant update, of the time remaining to complete a scan.
Why does the Excel file preview show some unexpected data such as numbers instead of dates?
The Excel file preview will only display text and numerical data. The Excel preview does not show colours, borders, etc., or other formatted information such as dates, which are numbers formatted to represent a date. If a preview is available, it is a good indicator that your file can be recovered. The recovered file will include all correctly formatted data.
Why are several files on Advanced Scan shown as active, when I know they should be shown as deleted?
This can occur on FAT drives e.g. removable drives, where each file on the drive has a record. If a file is deleted, it is marked as deleted and FileRestore for Networks will show this accordingly. However, if its parent directory was deleted, the files aren’t marked as deleted, only the directory they belong to.
Why do some of my scanned file names start with a question mark?
The “?” is used on short file names on FAT file systems, e.g. portable devices, to show that the first character of the file name has been lost. If the file only has a short 8.3 uppercase name then it will show the first character as a “?”
The “?” is replaced by default with _ when the files are recovered. You may choose to select an alternative replacement letter by removing the default (un checking the checkbox) from the Recovery Settings screen. Recovery Settings are available post scan. When you attempt to recover a file with the “?” (and the default is removed) you will be prompted to select an alternative first letter if required.
When an Advanced Scan is running on a FAT drive the files are shown to have a folder name of \Lost instead of its original folder name. Why?
To increase the speed of the scan, FileRestore for Networks may reconstruct folder names once the file scan has completed and the folder structure has been verified.
In some instances, the directory names are located after the file names on the disk. The folder names are then only “discovered” after the file has been located.
Using Manual Options, I have specified a Start sector value. When I try a Fast Scan, I get an error message. Why don’t I get this message when I try Advanced or Complete Scans?
On a Fast Scan, FileRestore for Networks will verify the data in the start sector to ensure it is a boot sector before proceeding. It uses the disk parameters to do its search. If the disk is corrupted etc., it can’t do a search correctly. If you set the start sector to, say sector 2000, which is beyond the disk’s boot sector, it is unable to locate the information it needs for the scan. Advanced and Complete Scan types work differently, by piecing together parts of the file system to make a “whole image” of what is on the disk. If the boot sector is missing, the Advanced and Complete Scan types can still locate the required data.
I have selected a folder for recovery. After changing from Folder View to File View mode, why is it no longer selected?
You may have selected an empty folder, i.e. a folder that has no files. Accordingly, when you swap to the File View there are no files selected from that folder. When you then swap back to Folder View, because no files from that folder were shown as selected in File View, the folder will no longer be ticked for recovery.
I have used Recovery Settings to select all files of a certain type. Opening Recovery Settings again in order to refine the selection criteria shows that the file type is no longer selected – why?
If you have originally selected a given file type and also included some other criteria such as a date range or condition type, only files matching ALL these criteria will be selected. This may mean that there are some files of that file type which are no longer selected. Once the Recovery Settings have been applied, unless all the files of a given file type match the selection criteria, that file type will appear unselected the next time you open Recovery Settings. To ensure all files of a given file type are selected, leave the other criteria options blank.
Where does FileRestore for Networks store the scan results? Might this overwrite my lost or deleted data?
FileRestore for Networks stores the results in the Windows temporary folder. This area was selected, as there is always a large turnover of files in this particular folder. For this reason, it will have the least impact on the integrity and safety of any other file and folder data, i.e. the data that you may be attempting to recover.
Why do the sector statistics shown in Drive Properties and Manual Options for the logical drives, differ from those shown for the physical drive containing the same partitions?
Drive Properties and Manual Options can be used to provide statistics on each individual logical drive (as selected using the Drive Selection drop-down). The start and end sector values for an individual logical drive will be shown as relative to their physical sector locations on the disk, i.e. the logical start sector will be shown as 0, and the end sector will be calculated relative to this.
Drive Properties and Manual Options can also provide statistics on these drives as partitions within the physical drive (as selected using the Drive Selection drop-down).
Using Drive Properties on a physical drive will show the start and end physical sector numbers of each partition on that drive. The start sector shown will be the first sector after the reserved area where the partition table is stored. On most operating systems this area takes up sectors 0 to 63 of each logical drive (on Vista this has increased to the first 2048 sectors). Thus the start sector shown for a partition on a physical drive may be 63 but will be shown as 0 for the matching logical drive; likewise the end sector for the physical drive partition may be 100063 but will be 100000 for the matching logical device.
Manual Options provides the same sector values as Drive Properties, for individual partitions within a physical drive. Manual Options also provides the ability to scan specific partition sector ranges, free space (on physical drives) etc. If an entire drive is selected, the start sector shown will be the physical start sector of the reserved area for that drive.
If I run an Advanced Scan on “Free Space” (where a partition was previously located), why does it list some of the files that are located as “Active”?
When the partition is deleted, only the 16 byte partition table entry pointing to the data is deleted along with, depending on the operating system, the boot sector. This means the entire file system is virtually complete and can be recovered by FileRestore for Networks with file status/attributes intact.
In Drive Properties, what are “Reserved Sectors” and why don’t they add up to be the same as the entire drive total?
The file system puts some spare sectors aside at the start of the disk for its own use. This reserved area is still part of the partition, but is not used for file storage. As for the entire drive size not matching the sum of the drive sizes, this is because the partition tables themselves use space, which isn’t part of any logical drive etc. For example, on most disks with a single partition, there are 63 sectors set aside at the start of the disk for the first partition, which is not part of that drive.
When scrolling between files whilst a scan is in progress, why does the product sometimes appear to pause?
This can occur while FileRestore for Networks is updating a file preview. If you are highlighting several files and the files are large, or if the files are located on a slower device such as a USB attached device, then this may pause the scan while the preview is updated. See “Why would I want to turn the Preview off?”
Why would I want to turn the Preview off?
Because of the overhead in generating the preview, particularly of larger image files, you may find the product is faster when switching between view modes, or scrolling while scanning for example, with the Preview turned off.
I am running a long scan, why is the computer appearing to slow down?
If a computer has limited memory (RAM), then this may, in certain scenarios, degrade the scan performance. FileRestore for Networks requires approximately 1 megabyte of memory per every 5,000 files found. On a computer with a limited amount of memory, the scan performance will degrade when the required buffer (for the files found) exceeds the actual available memory. This is only a potential issue when a system has limited memory, and only when scanning a high volume of files.
If scan performance is appearing to degrade, the memory usage can be reviewed using the Windows Task Manager. The available memory can be compared with the total number of files found, e.g. if 1,000,000 files have been scanned then approximately 200 megabytes of memory will be required. If there is insufficient memory available then the scan may be cancelled and the files scanned (up to this point) saved. The event log will detail the sector where the scan was aborted. To continue scanning the remainder of the drive, select Scan, Manual Options and put a value into the “Start Sector” field at a point prior to the sector where the scan was aborted. Select either an Advanced or Complete Scan type, and resume the scan.
N.B. If the resumed scan does not recover the outstanding data (e.g. if there is insufficient file system data available), it may be necessary to increase the size of memory (on the existing computer), or to attach the drive to a higher specification computer. The entire drive can then be scanned for all available data.
Why are previews not available during a scan?
In certain scenarios, during a scan, FileRestore for Networks may not be able to determine the number of sectors per cluster. FileRestore for Networks cannot therefore calculate the correct offset values to the file data. To ensure the integrity of the file previews, the previews will be temporarily suspended. Once the scan is complete, or has found enough data during the scan to determine these values, it will then display the file previews.
Why are there three preview types?
In some instances there may be insufficient file data to display the default preview type. There may however be some file data available. The additional preview types enable the user to determine whether there is useable data available. This also provides the user with a greater degree of confidence in the likely recovery of the file.
Why does the “Text Preview”, on image files for example, often show a few strange characters?
The text you are seeing is the file information marker at the start of the file. Most files have these at the start. It is normally a 4 byte string on most file types and is called a “magic cookie” or “magic number” which your program checks to ensure the file is of the type you think it is before processing the data. For example GIF89 would be the file type marker at the start of a GIF file - GIF means its a GIF file and the number is the year of the version of the file. You might see BM in the text displayed for a BMP bitmap file and Exif displayed for other image files (EXIF is a new standard for image file types meaning “extended information format” and contains information such as a digital camera make/model/serial that the picture was taken with).
Similarly, all EXE files start with MZ, PDFs start with %PDFXX where XX is the version and so on.
