File System Issues and Compatibility

> Problems and Solutions with lost files
> FAT 32 Problems and Solutions
> NTFS Problems and Solutions
> HFS/HFS+ Problems and Solutions

> Recovering from a VMware image
> Deleted files from Recycle Bin under Windows®
> Deleted files from Recycle Bin under Mac OS X
> NTFS encrypted files

> Compatibility

Problems and Solutions with lost files

> A file found with the help of the file signature search algorithm is called 'lost'. These files can be found on drives without any file system data or on a single drive after performing the Deleted File Recovery scan. Typically, these type of files can only be recovered if they are stored in one or consecutive clusters on the drive. Heavy fragmentation on the drive will adversely affect the recovery.
> If the file size of these lost files cannot be detected, they will be assigned a default size specified internally to the program. The default size may be too small for the detected file, e.g. if a bitmap file could be detected but the image is cut off at a position. In this case the size of the found lost file is too small and you can adjust the size for each single file by selecting Resize from the Expert menu. It does not matter if you specify a size above the real size of the file since most file types store their own correct size in the file.

> Another problem can occur if the recovered file is using an OLE Storage Format that is used by file formats like Microsoft® Word, Excel, PowerPoint, and many third party vendors. In this case EasyRecovery™ tries to detect the correct extension and rename the extension (e.g. to .DOC, .XLS or .PPT). If that fails the file extension will remain '.MOF'.

FAT 32 Problems and Solutions

> In Windows® 2000 & higher, whenever an entry (file or folder) is deleted the higher order word of the 32-bit starting cluster is erased by the operating system. Hence the correct value of the starting cluster at the time of recovering the entry is not known. Without the exact knowledge of the starting cluster, no recovery tool can find and successfully undelete a deleted entry. To overcome this problem, EasyRecovery™ has devised a solution. Depending on the size of the disk, it generates probable starting cluster values of the file/ folder selected for undelete. In the case of a folder, the program will automatically try all multiple combinations which may result in a delay during reading process. In the case of a file, it will ask the user to test each of the multiple combinations.

NTFS Problems and Solutions

> It has been observed that the file system driver (in the case of NTFS drives) attempts to optimize the space used by the MFT, resizing it each time the system is switched on. Once the MFT has been resized (if downsized), it is not possible to recover all the deleted entries.

HFS/HFS+ Problems and Solutions

> Mac OS X uses the HFS/HFS+ (Hierarchical File System) for storing data on the hard drive. This is very different than the FAT or NTFS used by Windows®. The Mac HFS/HFS+ file system uses journaling to minimize data loss. Basically, journaling involves tracking all of the changes made on the files in a volume on the Mac. Normally, this journal file can be used by the system to revert to a previous state of the data on the hard drive. However, in some cases, this journal file can be corrupted and reverting the system will be unsuccessful. Full recovery of the path and file names may not always be possible, but the data may still be recoverable. Using the Deleted File Recovery with the RAW selection checked will recover a large amount of this type of lost data.

Recovering from a VMware image

EasyRecovery™ Enterprise supports recovery of VMDK files stored on local file systems (i.e. VMware Workstation, Fusion) in either flat or sparse format. All “local” VMDK images are supported.

Note: VMDK files stored on VMFS file systems are not currently supported (i.e. VMware vSphere datacenter products).

VMDK images are virtual hard drives containing virtual operating systems running under a host system – typically Windows or Linux. Often there are multiple VMDK images created for each virtual system and choosing the correct VMDK image is critical for a successful recovery scan. To scan a VMDK file, load the VMDK image and choose the corresponding volume.

Reasons for multiple VMDK files:

· Multiple VMDK files called 'snapshots' (or 'delta links'). If you create a snapshot in VMware, it will start a new VMDK, and will never touch the original VMDK. All changes to the original VMDK will be written to the new VMDK and the new VMDK will increase in size.

· Multiple VMDK files called 'extents'. You can split the complete image data into several VMDK files.

· If the image uses more than one VMDK file, it will create another VMDK file, and that is called a 'descriptor' file. This very small descriptor file contains a description with links to all VMDK files that belong to the image.

Scenarios:

· If there is only a single VMDK file (no snapshots or extents), EasyRecovery™ Enterprise will find the embedded descriptor in that single file, and can use it.

· If there are multiple VMDK files, the customer needs to choose the descriptor file. Depending on what point of time the customer wants to recover, the corresponding snapshot descriptor needs to be chosen...the later the snapshot the newer the data.

If there is more than one VMDK file, choose the small VMDK file (descriptor). Depending on which snapshot (point in time) you want to recover, choose the corresponding snapshot (or if more VMDK files exist for that snapshot, choose the descriptor file belonging to that snapshot). The newer the snapshot, the more complete the data.

Deleted files from Recycle Bin under Windows®

> When a file is sent to the Recycle Bin under the NTFS operating system, the file name is no longer preserved. The files will be renamed into 'D drive letter deleted file#'.

> When recovering files that have been removed from the recycle bin (folder 'RECYCLER') look for 'D' followed the drive letter of the original file, followed by a number. For example, a file deleted from the E: drive may be named 'DE10.DOC', a deleted file from C: drive may be named 'DC.XLS'. The file extensions will be preserved as well as the deleted date. This rule does not apply to files which have been deleted from The Command Prompt or from within applications, they will retain their file names.

Deleted files from Recycle Bin under Mac OS X

> When a file is deleted under the Mac OS X operating system, the file is moved to the trash bin. Once the file has been removed from the trash, the name is completely wiped from the HFS+ file system. The only way to recover the data is to look for the raw bits and bytes of the file using the file signature search algorithm. Therefore, it is very important to make sure when scanning a Mac volume for deleted data, the RAW analyzer option is always selected.

NTFS encrypted files

> When saving encrypted files, guarantee that you are using a Windows® NT-based operating system that supports encryption (Windows® 2000/XP) and save the recovered data to a NTFS drive. Otherwise the encrypted file cannot be decrypted and will be saved in a packed raw encrypted format using the extension '.$efs'. Files with this extension can be imported later to a NTFS drive using the additional EasyRecovery™ tool 'efsimport.exe'.
> If you have recovered an encrypted file of a user whose account is no longer available or who loses his private key (e.g. due to a system crash) you may use one of the following solutions to read the data again:

> - Use the Windows® NT Certificates snap-in to import the user's Certificate to read the file. This presupposes that you have exported the user's certificate before.
> - Recover the file as Recovery Agent (encrypted files are encrypted with the user's key and a Recovery Agent's key, a delegated person whose account is configured as Recovery Agent).
>   The recovery agent can go to the machine with the encrypted file, load his recovery certificate and private key, and perform the recovery on the machine.
>   NOTE: In a small business or home environment where there are no recovery agents, the recovery can be done on a stand-alone computer using the local administrator account, which by default is configured as the recovery agent.
> - Back up your encrypted files (using Microsoft Backup) to a .bkf file and send the .bkf file to the Recovery Agent's computer. The Recovery Agent should restore the files on a secured system, decrypt them and send them back to the user.

> Refer to your Windows® operating system manual to get more information on decrypting encrypted (encryption recovery) files that have been saved to a NTFS drive.

Compatibility

> EasyRecovery™ is compatible with all Windows® and Mac OS X file systems. Due to the way EasyRecovery™ accesses the disk drive(s), some antivirus, adware, and anti-spyware tools may report an error. For best results, disable or uninstall any antivirus, adware, and anti-spyware tools before running EasyRecovery™.

> EasyRecovery™ is also compatible with ISO9660 and EXT2/3 file systems as well as drives with no file systems (RAW).

> Drives and devices with physical damage cannot be recovered using EasyRecovery™ software. These devices should be sent in to our lab for physical recovery. For more information on that, please contact us here.

EasyRecovery™ is a trademark of Kroll Ontrack Inc.
Microsoft and Windows are trademarks of Microsoft Corporation. All other trademarks are the property of their respective owners.