Browse, Search, Preview and Recover deleted files
Pandora Recovery allows you to find and recover recoverable deleted files from NTFS and FAT-formatted volumes. Pandora Recovery will scan your hard drive and build an index of existing and deleted files and directories (folders) on any logical drive of your computer with supported file format. Once the scanning is complete you have full control over which files to recover and what destination to recover them to. You can BROWSE the hierarchy of existing and deleted files, or you can use SEARCH functionality to find a deleted file if you remember at least one of the following:
- full or partial file name,
- file size,
- file creation date, or
- file last accessed date
On top of that, Pandora Recovery allows you to preview deleted files of certain type (images and text files) without performing recovery. This feature becomes really important if you are forced to recover deleted files to the same drive. Currently you can preview files having several image file types (BMP, GIF, JPG, PNG, ICO,TIF, TGA, PCX, WBMP, WMF, JP2, J2K, JBG, JPC, PGX, PNM, RAS, CUR) and several text file types (TXT, LOG, INI, BAT, RTF, XML, CSS). Quick Viewer allows you preview file contents as text if it cannot find appropriate viewer for it. To use quick viewer you can select deleted file and or click the Quick Viewer icon or right click on deleted file and select 'Quick View'. Quick View will then display a preview of deleted file.
Finally, Pandora Recovery allows you to recover deleted files, without any limitations on application's end. Note that successful recovery might not be possible - if the original location has been reused by operating system to store different content the integrity of the original content has not been preserved and the recovered data will most likely be corrupted.
Surface (cluster) scan
As of version 1.1.20 Pandora Recovery implements surface (cluster) scan of targeted media, which allows:
- recovery of files whose MFT record has been reused by OS,
- Recovery of files from reformatted media,
- Recovery of files from discs with damaged or missing file allocation table.
Disk surface scan enumerates all unused clusters on the disk drive and searches for disk areas probably occupied by the data of removed files. Using this method of search, we do not use information contained in the file allocation table. So, it can work even on reformatted disk drives (except in) the case when low-level formatting was performed).
Almost each type of files has its unique features, for example the beginning of a JPEG file always contains JFIF magic word. Using this information we can determine what areas of the disk may contain deleted files data. Knowing the structure of a file (which is common within one file type) we can determine the length of the file and then recover file data.
File name and file attributes information are stored separately of the file data in file allocation table (FAT in FAT32 file system, MFT in NTFS), so we cannot determine the name of the file, its attributes, file path and recover data of file alternative data streams.
This method works only with non-fragmented files. Data of non- fragmented file(s) are stored in contiguous neighbor clusters, while data of a fragmented file may be stored in different places of the disk.
Remarks: In NTFS small files (less than 1KB in size) reside only in the Master File Table (MFT), so we cannot find such files using the Surface Scan Method.
Recover Archived, Hidden, Encrypted, Compressed files
Pandora Recovery can recover not only 'regular' files, but also archived, hidden, system, sparse, encrypted and compressed files.
Windows 2000 introduced Encrypting File System (EFS), which supports file encryption. EFS service runs on top of NTFS and encrypts or decrypts files or folders transparently for users and applications. Pandora Recovery does not decipher contents of encrypted files. Instead of that it copies the content of an encrypted file in raw mode just like data back-up applications do.
Encrypted and compressed files will be color-coded once drive indexing has been completed. Names of the encrypted files will be displayed in GREEN, while compressed files will be BLUE.
Recover Alternate Data Streams (ADS)
In NTFS all files have at least on file stream also called the unnamed $DATA stream. The unnamed stream contains the actual data of the file. Alternative streams usually contain file-related metadata. For example, MP3 music file may contain unnamed stream, where data are stored, and one or several additional streams where composition genre, album name and author's name are stored.
While file might be usable without the original content of its Alternate Data Streams this useful information should be recovered. Alternative streams often contain file metadata, while file attributes contain information about how files are displayed in Windows Explorer.
Recover Images, Documents, Movies, or any other type of files
Pandora Recovery handles files regardless of their type, size or any other attribute. As long as the space on the logical drive has not been reused by operating system Pandora Recovery can successfully recover content of any deleted file.
If you want to search for unspecified deleted images or movies the best strategy is to search for common file extensions:
- *.avi, *.mpg, *.mov for video
- *.bmp, *.jpg, *.png, *.gif for images
Recovery success estimate
When a file has been deleted, the disk space occupied by the file can be reused by file system. The file system can reallocate this space for data of newly created files. Once operating system does that the deleted file becomes partially or completely overwritten. There are more chances that an overwritten file is corrupted and can not be recovered successfully. Overwritten files can still be recovered, but they likely will not be usable.
If clusters once used by a file have been reused by another already deleted files Pandora Recovery will display 0% as 'overwritten' value, which means the clusters are not currently in use. Still, the recovered data is likely to be corrupted.
Pandora Recovery gives you an estimate of recovery success by displaying the percent of clusters reused by operating system. To view the estimate move the mouse pointer over a file for a second or two until popup tip is displayed. The tip will say "Overwritten: 50%" or "Overwritten: 0%" . The higher the percent, the lower the chance of successful recovery.
Names of files with partially or completely overwritten clusters are displayed in RED.
Review File properties and Drive properties
Pandora Recovery displays properties of files: file type, deletion status, percent of clusters reused ('overwritten' attribute), path and size of the file, date created and date modified and common attributes (compressed, archived, hidden, system, encrypted...). To display file properties you should right-click on a file and select 'Properties' from context menu.
Pandora Recovery also displays properties of available logical drives: Drive letter, volume label, type, file system, total and available size. To display drive properties you should right-click on a logical drive and select 'Properties' from context menu.
Recover to Local Hard Drive, Network Drive, or Flash Drive
Pandora Recovery can use local hard drive, remote network drive or flash drive as a recovery destination folder. Pandora Recovery even allows you to recover deleted files on the same drive that the deleted files resided on originally.
IMPORTANT! To increase the success rate of file recovery it is strongly recommended that you recover your deleted file to a secondary hard drive, a network drive, USB Flash drive, or other external media. While recovery to the same drive that the deleted files reside on is physically possible it may lead to partial or complete loss of your deleted content. Non-deleted files will never be put at risk in either circumstance.
If your lost data resides on your C: it is recommended you perform your file recovery by physically removing the C: drive from your computer and attaching it as a slave on another computer and then performing the file recovery using that other computer.
Recognizes FAT16, FAT32, NTFS, NTFS5 and NTFS/EFS
NTFS (New Technology File System) is the default file system in all modern operating systems from Microsoft, such as Windows NT, Windows 2000, Windows XP and Windows Vista. NTFS 5.0 is improved version of NTFS introduced with Windows 2000.
NTFS replaced Microsoft's previous FAT file system, used in MS-DOS and early versions of Windows. NTFS has several improvements over FAT such as improved support for metadata and the use of advanced data structures to improve performance, reliability, and disk space utilization plus additional extensions such as security access control lists and file system journaling. The exact specification is a trade secret, although (since NTFS v3.00) it can be licensed commercially from Microsoft through their Intellectual Property Licensing program.
NTFS5 (where 5 comes from internal enumeration of Windows 2000, the operating system which first implemented NTFS v.3.00) includes several new features over its predecessors: disk usage quotas, sparse file support, reparse points, distributed link tracking and file-level encryption, also known as the Encrypting File System (EFS).
FAT16 based on the usual 512 byte sector size and used with MS-DOS and Windows 3.xx, has a maximum partition size of 2 Gigabytes. FAT16 does not natively support alternate data streams or file permissions and it is not a journaling file system.
FAT32 was introduced with Windows 95. It is the standard file system used in Windows 95/98/Me. The theoretical Maximum partition size for the FAT32 file system is 8 Terabytes. However, in Windows 95 and 98 the size is limited to 127.53GB because to the disk 16-bit disk utilities included with the operating systems. Windows 2000 and later operating systems should be able to support the theoretical maximum size of FAT32, but Microsoft has placed an artificial limit which only allows formatting up to 32GB volumes on Windows 2000 and XP. The Maximum file size that can exist on a FAT32 formatted partition is 4GB. This has become a major factor in rendering the FAT32 file system obsolete for use on a personal computer hard drive. Media files can easily exceed this maximum size. FAT32 does not natively support alternate data streams or file permissions and it is not a journaling file system.
Compatible with Windows Vista, Windows XP, Windows 2003 and Windows 2000
Pandora Recovery requires Windows 2000, Windows XP, Windows 2003 Server or Windows Vista for installation. Pandora Recovery currently only recovers deleted data from NTFS formatted drives. There are no plans at this time to create a version compatible with the Mac, Linux, or any other non-Microsoft Operating System.
