| Author | Message | ||
     dani karsa prawira Username: daniprawira Registered: N/A |
Hi, maybe this wuestion has been uploaded before from others user, i just want to ask. When we tried to recover files using : Tools --> Disk tools --> File Recovery by_type. The generated files is used different names from the original files?Could we using the original names when generate the files using recover by_type tools? thanks before | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
This is simply not possible. The approach taken by "File Recovery by Type" (also called "file carving") utilizes no file system data structures to recover files, so that filenames and timestamps etc. are unknown. It only looks for file header signatures, i.e. charactertic byte sequences that are characteristic for certin file types that can be found in the file contents. X-Ways Forensics finds many deleted/lost files automatically. They are part of the volume snapshot and they are presented in the directory browser when you navigate to the directory where they were located or when you explore recursively. You can very easily recover them (if needed at all, i.e. if the ability to view and report them if necessary is not sufficient already), by selecting them and using the Recover/Copy command in the right-click menu (directory browser context menu). And you can invest more time and make an additional effort to find more deleted files by refining the volume snapshot (Specialist menu) and running the particularly thorough file system data structures search (which, if successful, also lists files with their original names) and the file header signature search (which as a last resort will list files that cannot be found via file system data structures with a generic name like File Recovery by Type in the virtual folder \Path unknown\Carved files). This is by far superior to just using the File Recovery by Type command, and the File Recovery by Type functionality itself tells you that it is obsolete because you are much better off using the more powerful Refine Volume Snapshot command and the directory browser. This is the core functionality of X-Ways Forensics, and I cannot recommend highly enough that you make use of it and familiarize yourself more with the software, since there is so much more to discover. Since some years now, the File Recovery by Type command, although superior to simple file carving functions found in other tools, is actually no longer needed in X-Ways Forensics. | ||
| dani karsa prawira Username: daniprawira Registered: N/A |
Hi, Thanks for your explanation, just want to make sure..So we just using the icon deleted files to recover deleted files right? And recover it. The another question, when we tried to add image the x-ways is automatically recover the data files right?need your explanation on this. thanks | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> So we just using the icon deleted files to recover > deleted files right? The icons tell you which files are deleted files and which ones are existing files. You can select any files in the directory browser, deleted or existing, and recover/copy them with the Recover/Copy command in the directory browser context menu. Often it is not needed to copy them off the image because you can do most things with these files in X-Ways Forensics itself (view them, comment on them, include them in a report if necessary). > when we tried to add image the x-ways is automatically > recover the data files right It usually automatically finds many deleted files. They become part of the volume snapshot (the database internally used by X-Ways Forensics) and are listed in the directory browser. If you are ready to invest more time, you can refine the volume snapshot as I mentioned before to have a chance to find even more deleted files. | ||
| kill robert Username: kimkill Registered: N/A |
what can i explain about the boot sector...how can i recover data which was deleted, what do i need to do with winhex inorder to recover it? | ||
| hdd tech Username: akcomp Registered: N/A |
Hi Stefan We need your assistance for a Raid Recovery case. Our Iomega NAS box is invisible after firmware upgrade ( model Storecenter pro 150D 2TB) It has 4 hard disks 500GB each. Volume size was 2Tb so it must not be in RAID 5. It could be 2 raid o's in JBOD or , we dont know how its assigned. We will purchase winhex 15.2 Professional version if demo version could help us rebuild lost volume. Disks are in perfectly working condiftion and there does not seems to be problem with it. We tried R-studio /Runtime softwares Raid Reconstructor & UFS explorer but are not happy. Can you please guide step by step how to rebuild this volume? Unfortunately we are very poor in hex level of work , though we have started reading winhex manual so please explain it in bit details. Thanks & Regards Hitesh | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
Specialist | Reconstruct RAID System JBOD is not currently supported, sorry. |