Immediately turn your system off and disconnect the drive. DO NOT DO ANYTHING WITH IT BY YOURSELF ANYMORE! Bring the drive to qualified data recovery professionals. They have special equipment, software, and, most important, required skills to work with such drives. Neither R-Studio, nor other data recovery software will help you in such case. Moreover, any further tampering with such drive will surely inflict more damage to your data. Quite often such damage is mortal to them.
Symptoms that a hard drive has hardware problems:
Your system does not recognize the device anymore, or it appears under unusual name.
SMART inspecting programs report a severe hardware failure event.
The hard drive makes unusual noise, clicks, starts too slowly.
Bad blocks constantly appear on your hard drive.
OS considers deleted files as just free space on the disk. And it always reads and writes some data during its operation. So there are always chances that it will overwrite your lost files and make it recovery impossible. So the best practice would be to avoid starting your computer with lost files. Instead, disassemble it, disconnect the hard drive with lost files and connect it to another computer where R-Studio or R-Undelete is installed.
To avoid disassembling the computer, R-Studio users may use either R-Studio Emergency or R-Studio Agent Emergency and data recovery over network for R-Studio Network version. See R-Studio documentations for more details.
In any case, avoid installing the data recovery software on the disk the lost files are reside. Do not restore files or write images into the drive that contains deleted files.
It is also a good idea to create an image of the disk with lost files and save it to another disk. You may use those images to recover your files instead of the original disks preserving the original data from accidental corruption.. All R-TT data recovery utilities (even in their Demo mode) create and process such images. Moreover, all R-TT data recovery utilities understand images created by any R-TT utility.
R-Undelete is a light version of R-Studio intended for less experienced users. It has a wizard-oriented user interface and a smaller feature set. Still, it uses the same IntelligentScan technology and can solve most everyday data recovery tasks. You may compare R-Studio and R-Undelete on the Undelete Software page.
Not automatically. If you have a deep understanding of the file system, you may use Text/Hexadecimal Editor built into R-Studio to analyze the damage and recover the data. But if you are not an expert in file system it is better to consult a data recovery professional.
Sometimes, scan for Known File Types may help to recover non-fragmented files.
And remember! NEVER use any partition managing software unless you have all your important data backed up.
Not automatically. If you have a deep understanding of data structure of a hard drive , you may make the necessary changes in the MBR manually in R-Studio Text/Hexadecimal Editor, but you should be absolutely sure what are you going to do or you may further damage the MBR.
You may either use R-Undelete or R-Studio software to recover accidentally deleted files.
If you have only one logical partition on your system hard drive we'd recommend you to remove the HD from the computer (PC1) and attach the HD to another computer (PC2) where R-Undelete or R-Studio is installed. You may attach the HD as a slave drive or use an HDD-to-USB adapter (a USB2.0 compatible is highly recommended to have higher data transfer rate). A notebook HD can be connected to the PC2 through a special adapter as well. Then run the software on the PC2 and search lost files on the attached HD.
If you do not have an alternative PC where you can connect the drive, you should use only R-Studio with the following options:
1. Download R-Studio Emergency Media Creator to PC2 and create R-Studio Emergency Startup disk. Start the PC1 with the startup disk and recover data using R-Studio Emergency. Please note that R-Studio Emergency does not support files preview.
2. Install R-Studio Network and download R-Studio Agent Emergency Media Creator to PC2. Connect both PCs to the same network, either directly or through some hub/switch. Run the R-Studio Agent Emergency Media Creator and create R-Studio Agent Emergency startup disk. Start PC1 with the startup disk and establish a network connection between PC1 and PC2. Recover lost data over the network.
Yes, you may find them. You may try our R-Undelete Demo and check if our software can find files deleted from Recycle Bin. Please note that file/folder usually lose their original names when they are moved to Recycle Bin. Check the date or /and size of such found folders/files. It may help you to figure out which files/folders are you dealing with. That is how files are deleted in the Windows OS.
Probably yes, if you have not installed an operating system or write new files on the new disks. Scan the hard drive where the old disks resided and find them among Recognized partitions. Most likely they will be among the yellow ones.
A Red cross on the icon means that the file has been intentionally deleted. Files without the red cross are files that exist or existed on the disk. They may be lost from the system due to file structure corruption (especially when found on Recognized partitions.)
A folder names like '$$$Folder58448' means that the folder itself has not been found on the disk only some references to it. For example, folders 'My documents', 'Work', 'Photos' have been found and all they have one parent folder, which description has not been actually found on the disk, so its name is unknown and therefore presented as '$$$Folder58448'. Perhaps the description of such folders was just outside of the scan area - so try to expand the region or scan the entire disk. If it does not help the description of the folder is most likely overwritten.
Chances that you may recover your files from those partitions. Green partitions are most likely to keep all the files, yellow ones are less likely, and red one are the worst, but still worthy to browse through.
Under Windows 2000/XP/2003/Vista/2008/Win7/Win8, R-Studio recovers files from all hard drives and logical disks visible by the host OS.
Under Windows 95/98/ME, R-Studio recovers files from all logical disks visible by the host OS and from all hard drives correctly accessible by the Windows protected mode I/O subsystem.
R-Studio network edition also recovers files from disks of a remote computer if R-Studio Agent or R-Studio Agent Emergency is running on them.
On Windows 2000/XP/2003/Vista/2008/Win7/Win8 operating systems R-Studio will recover files with file names up to 32000 characters and restore original file names in any national encoding.
On Windows 95/98/ME there is a 255 characters limit for a file path size for recovered files. File name encoding is limited by the language currently set in Windows. Files with other character encoding will also be restored, however the file name will be altered to fit the Windows limitations.
On any device accessible by your operating system. Recovered files may also be saved to a network share specified by a UNC path (such as \\myserver\myshare). You may select a recovery path from a standard Windows directory dialog or enter it manually. Please note that the file system of the drive to which the recovered files are to be saved may limit NTFS files extended information recovery.
No, that does not. Each file should be treated separately even the rest of files in the same folder can be recovered successfully. Unfortunately, each file you want to recover should be tested by previewed. Please check the R-Studio help to be sure that that file type can be previewed in R-Studio (see also the R-Studio Extended Viewer module).
While scanning, R-Studio tries to find all file systems that ever existed on the disk. It also tries to find lost files by their file characteristics typical to particular file types. That makes the scan process a long-time procedure.
If you scan a NTFS disk, it has two copies of its MFT table. The primary one is on the disk beginning, the secondary one in the middle of the disk. You may cancel the scan when it passes 5-10% of the disk. In this case, most likely R-Studio will be able to re-construct the file structure of this disk.
If you know which file system you are looking for, leave only this one before scan in "File Systems" field on the Scan dialog. You may also disable Extra Found file or leave only those that you are interested in. Also, check that I/O Tries on the Property tab is set to 1.
No, R-Studio scans the objects on the low level. The scan tries to find any files system that exists and/or existed on your HDD, rather than a specific folder or file. You may use the Find or Mask command after a scan.
You cannot recover data using only the scan info of the disk. You need that disk, too. Scan info is the information on the data structure on the disk, not the data themselves. You do not need to scan the disk one again, though, just load the scan info. That saves a lot of time.
Well, R-Drive Image can create two types of images. One when it writes to the image file only existing data (Image Options -> Backup actual data only) and the other when it creates and exact copy of the entire object (Image Options -> Sector by sector backup). The first image type cannot be successfully used to recover deleted files. You need to create the Sector by sector backup.
R-Studio is recovery rather than imaging software, so the answer depends.
If you created a compressed image then you can use our R-Drive Image to restore it. If the image is uncompressed then you can use R-Studio's built-in hex editor to restore the image but no adjustment to the partition geometry can be made.
In the newer version, an R-Studio image can be used by another our software, R-Drive Image, to restore it onto another HDD. So, if your R-Studio image was created by the version that supports such images, then you need R-Drive Image to do so.
R-Studio is licensed per machine not per user and you can't transfer the software from one PC to another if the software has already been installed and registered once.
However you can attach any HD like a slave drive (directly or through adapter for laptop's HD) to a PC where R-STUDIO is installed and recover lost data. It means the PC where R-Studio is installed can be used as a data recovery station and there is no limitation for attached or connected HDs.
For data recovery service companies or individuals we recommend R-Studio Technician License http://www.r-studio.com/#technician-package .
Please, do the following:
1. Delete registry hives:
2. Delete manually the R-Studio's folder (by default it is C:\Program Files (x86)\R-Studio\)
3. Reinstall R-Studio
4. Launch it.
5. If that does not help, try to run it from the command line with switches
-debug -log file_name
6. If still no success, rename rs_un.bin to rs_un.exe and try to launch it.
Sometimes R-Studio can find the files but not the entire file paths to them. It puts such files into the Extra Found Files folder. It is a good idea to search for the files there. If that does not help, try to find them by using file search globally on the entire disk. (R-Studio Help -> Data Recovery Using R-Studio -> Basic File Recovery-> Searching for a File).
You need to attach your Linux drive to a Windows computer, and then restore the files using R-Studio. No matter how that system recognizes your drive, R-Studio should access it. You may also start your Linux computer with R-Studio Agent Emergency startup disk and recover data over the network using R-Studio network features.
Apparently, you try to save the image on a disk with the FAT32 file system which has a 4Gb file size limitation. If this is the case, either save the image on a disk with the NTFS file system, or split your image file into parts lesser than 4 GB. Then you may open those images in R-Studio, create a virtual volume set, and process it like your original disk.
An MFT record of a file contains some self-validation values. One of them is known as 'fixup'. So if the MFT record is broken, then the following warnings can appear:
'[FileId: XX] Fixup out of bounds'
'[FileId: XX] Fixup XX is XX, but should be XX'
These are not fatal errors. They mean that the file system information for the file is most probably overwritten. If so, there is a risk that that file cannot be recovered.
R-Studio supports recovery of compressed files, alternative data streams, encrypted files, file security and extended file attributes. If the R-Studio host OS and the file system of the disk you are going to save file to support any particular extended information, it will be saved with the file, too. Otherwise, the extended information will be saved as separate files with the same name as the restored file and extension showing the type of the extended information. Below is a quick reference for the host OS and file system of the target drive.
There are 2 causes for that. First, you are recovering files both from the actual folder/file structure and from files found as Known File Types (files found by their signatures). In fact, that may double the total size of recovered files, as some files may be recovered twice. You may select only one recovery method (from the found file system or from Known File Types), but that may reduce the number of successfully recovered files.
Second, as the previous file system was corrupted, R-Studio may determine some file sizes incorrectly, much larger than their actual sizes.
The problem is that when a fresh NTFS disk re-formatted by Windows XP or Vista is connected to a Windows 7 computer, Windows 7 automatically and quietly extends the $MFT file to its default size of 256KB, effectively wiping out all file records stored on that place in the $MFT file of the previous file system. Given that a file record occupies 1KB in an $MFT file and there are first 27 system files, that results in a possible loss of 229 user's files from the previous file system. In comparison, XP creates a new $MFT files of 32KB wiping out the records of 5 user's files, Vista creates a new $MFT file of 64KB wiping out the records of 37 user's file.
Those lost files can be recovered using only scan for Known File Types (by file signatures)
No. You will have to find the correct order by yourself. In addition, you have to specify block size and offset correctly, too. As a test point, select a file which is larger than a block size for the RAID and try to preview it. If the preview is correct, you have constructed your RAID correctly.
The file size should be large than block size x (Number of all disks - number of parity disks).
You may see some useful information on how to find the RAID parameters in our article Finding RAID parameters
You should not forget to create a "Missing disk" object to replace the broken actual drive. That object will tell R-Studio that there are 4 drives in this RAID5 configuration, but the second drive is missing.
Yes, you can. You may create a Virtual RAID from any objects visible in R-Studio, be them real HDDs or images. In your case you will have a Virtual RAID consisting of 3 real HDDs and one image. You should open the image file in R-Studio before you can add it to your Virtual Array.
R-Studio may help, or may not. You cannot run R-Studio or R-Studio Agent on a NAS device directly. You need to connect disks from it to a conventional computer with R-Studio installed and try to recover data that way. Please note that most NAS devices run under some versions of Linux, FreeBSD, or other UNIX-like OS. That means that they use Unix-type file systems. Not all of them are supported by R-Studio, although you may use scan for Known File Types to recover your files. See R-Studio Help -> Data Recovery Using R-Studio -> Advanced Data Recovery -> Disk Scan -> Known File Types for more details on Known File Types.
R-Studio Emergency and R-Studio Agent Emergency are based on different kernels so they may support different hardware sets. Probably you need to use R-Studio Emergency and saved recovered files to a network drive.
Yes, you can. Create an R-Studio Agent Emergency Startup disk on your Windows computer, connect the both computers over network, start the Mac computer with the R-Studio Agent Emergency Startup disk, and recover files over network.
You may use this method for Windows, Mac, UNIX, and Linux OS, running on Intel and PowerPC platform.
There are two possible causes for that:
1. An effect of so-called “lazy write”: When a file (especially, a small one) is being saved, Windows doesn't write it to the disk immediately. Instead, it puts it to a disk cache in computer's memory to write the file to the disk at the nearest convenience. Meanwhile, the file is accessible to the system and programs through that cache. If you delete the file before it's actually written to the disk, Windows deletes it from the disk cache, and the file may not be written to the disk at all. R-Studio (and any other data recovery software) reads data from the disk directly, bypassing the disk cache, what's why it may not find such file. Even more, when a file already written to the disk is being deleted, the deletion is also stored in the disk cache and may not be saved immediately to the disk. In this case, R-Studio (and any other data recovery software) would find the file on the disk as undeleted.
To avoid such confusion, the test procedure should be as follows:
1. Create a file and save it to a disk.
2. Restart the system. During the restart, Windows will save all changes made to the files to the disk. Or you may use a disk cache flush utility that saves the changes to avoid system restart.
3. Delete the file.
4. Once again, restart the system to save the file deletion. Or flush the disk cache.
5. Recover the file using R-Studio or R-Undelete.
If you use an external disk for the test, you may properly disconnect it using the Safely Remove Hardware icon instead of system restart.
2. The MFT record of the file is overwritten (re-used) when another file is being saved to the NTFS-formatted disk. That rarely happens if the file is created, saved, and deleted during a short time. But chances for that are much higher if the disk is almost full. In this case, Windows may need the disk and MFT space for its own service files, which it constantly writes to / reads from the disk. If it is the case, the file data may remain on the disk and can be found during a disk scan for Known File Types among other Extra Found Files. Please note, that in this case the name of the file cannot be recovered. R-Studio uses a fake filenames like 12345 and places it into a corresponding file type.
Moreover, if the file is small enough (less than 1 KB), Windows stores it within the MFT itself and, if the MFT record is overwritten, the file cannot be recovered at all.
No, R-Mail is an email recovery program that may find lost or deleted e-mails inside an existing pst file. What you need is a File recovery tool that may help you to find the deleted pst file. Please use R-Studio Demo and additional R-Studio Extended Viewer. You should try to find the deleted pst file and preview it.
No, Yahoo e-mail and the likes are located in a remote Yahoo EMAIL server. You may try to find an Http page with your email in the temporary IE pages (or those for other Internet browser you use) or/and contact the Yahoo technical Support team.
Yes, it may help in your case. Of course, the more time has past since then they were deleted the less chances you will recover them, but still it is worth trying. Only an attempt to recover them gives you a conclusive answer. Please download R- Mail demo and try it. You may find and preview found emails in this Demo program.
Yes, you can. You may do it in different ways: by opening the email message one by one or export them and import them. Please read the R-Mail help to get more information on performing these operations.
Simply save all (or just required) messages in an empty folder as the eml files, select all of them in Windows explorer (Ctrl-A), and drag and drop them into the required folder in Outlook Express window.
Sometimes, it may be impossible to start a Windows 8 computer with the R-Studio Emergency or R-Studio Emergency Agent startup disk. This happens because any computer should use a so-called "Secure boot" procedure to comply with Windows 8 hardware certification from Microsoft. In brief, this procedure prevents computer from booting into any operating system that isn't digitally signed with an appropriate digital signature. "Secure boot" is claimed to prevent unauthorized modification of the boot sector by bootkits, viruses, trojans, and other malicious software. To the date, only Windows 8, Windows Server 2012, and selected Linux distributions support this feature. As a side effect, it also prevents most LiveCDs, rescue disks (R-Studio and R-Drive Image included), and other OS from running.
Likely enough, the other requirement of Windows 8 hardware certification is to make it possible for the user to disable the Secure boot procedure. Those settings can be done through the system BIOS under the Boot options. Generally, it's enough to enable Legacy support in those options, but sometimes it may require additional actions. Please, refer to your system documentation to learn more about disabling/enabling Secure boot.
When Secure boot is disabled, it should be possible to start the computer with the R-Studio Emergency or R-Studio Emergency Agent startup disk.
Please note that you should enable this feature back after using the startup disks because Windows 8 or Server 2012 may not start properly without the Secure boot feature enabled.