This article explains RAW Recovery vs. File System Recovery. File System Recovery is able to preserve the directory tree. Some times RAW Recovery is the only option.
To recover data from a victim disk two methods are available to data recovery software. They can try to detect files using still available file system structures or file system recovery. Or they can do file carving or RAW recovery.
File System Recovery.
File System Recovery using file system structures: The data recovery software will scan the disk for things like boot sectors, directory structures, indexes, File Allocation Tables (FAT), and MFT entries. Then it has to combine that info to figure out volume parameters. It needs to figure out where a volume starts, the size of the volume and the cluster size.
If it can not figure out for example the cluster size, all references to clusters are meaningless. If for file X file system structures point to cluster N then the software needs to know that start of the volume and the cluster size.
File recovery using file system structures often allows the software to also determine the original folder structure. In NTFS it is possible to reconstruct a directory tree even when all original Indexes are lost, purely based on information that can be found in MFT entries.
File System Recovery: Software presents data in a directory tree
RAW Recovery.
RAW Recovery or file carving is possible even then the file system or it’s properties such as cluster size are unknown. It relies on knowledge of actual file properties. Many file types start with an easy to recognize sequence of bytes. For example, JPEG image files all start with “ÿØÿà..JFIF”.
So all the software has to do is check each sector for the occurrence of this string to know it has found the start of a JPG file. Easy to detect strings like these exist for a lot of file types, but not all.
Same disk scanned. This software fell back to a RAW scan. Data is organized by file type.
Drawbacks of RAW File Recovery.
One major drawback of RAW recovery is that the original file names can often not be recovered. The original folder structure can never be recovered. Most of the times, files are ordered by type.
Second major disadvantage of RAW file carving is that fragmented files can not be recovered intact: The software assumes that after it has found the magic header of the file (those bytes we just talked about), the rest of the file will follow in one piece.
Digital Image recovery software often uses the RAW file carving technique, which isn’t really a problem as filenames as they are created by digital cameras are often generic and kind of meaningless. The files are also often stored in one directory on the memory card, so recovering a directory structure is not required.
During my tests of data recovery software I found that the majority of the software is very weak at method 1, recovery using file system structures. As kind of a fall back system they then use RAW file carving to produce results.
Test can be found here: DIY Data Recovery from unknown disk – Data Recovery Software Tested.
The test scenario is a little more complex than a formatted disk, but it should give an idea about the ability of the software tested to create a directory tree. Scenario is described here: DIY Data Recovery from unknown disk – Semi detailed analysis
Of the software tested so far only Ontrack EasyRecovery, MiniTool Power Data Recovery, Easeus DataRecovery Wizard and DIY DataRecovery iRecover were able to recover file names and a directory structure.
The post File System Recovery vs. RAW Recovery appeared first on DiskTuna free defrag software.