Data Recovery Issues

Cross-Linked Folders

Often Restorer2000 finds several FAT folder records that contain the same data. Such folders are called cross-linked. Restorer2000 marks such folders with an arrow mark:

Restorer2000 attributes the content of cross-linked folders to one folder called a target folder. When restoring Restorer2000 places the content to the target folder.

To view the list of cross-linked folders,

Select the cross-linked folder and select Goto Target in the Files menu

You may go to any folder in this list by clicking it.

To find a target folder,

If Go Target is gray, this folder is already the target folder.

To set the target folder manually,

Select the cross-linked folder and select Set As Default Target in the Files menu.

If Set As Default Target is gray, this folder is already the target folder.

Questionable Folders

Sometimes, Restorer2000 may find FAT records, which look like folders, but their content is invalid. For example, file names have invalid characters, date, time, and size, or other file attributes may look strange. Please note that Restorer2000 correctly recognizes localized names. Restorer2000 treats such records as folders, but does not analyze their content and structure. You can manually scan such folders, but results may be unpredictable. Usually, such scan reveals garbage.

Restorer2000 marks such folders with a question mark.

To re-scan an object,

Select the questionable folder and select Rescan in the Files menu.

File Restoring Issues

Restorer2000 writes directly to a hard drive only when writing restored data and from its hex editor, if writing is enabled. In all other actions, Restorer2000 only reads data and analyzes them, and never modifies data on the hard drives being analyzed.

Most operating systems use lazy-write. So, there is a time lag between file actions and actual changes on data on a hard drive. Restorer2000 analyzes data on hard drives only. That is why it does not always detects recent changes in data structure.

Most operating systems constantly write their service information on hard drives. Such writing is especially intensive during start-up and shut-down procedures. When an operating system deletes a file/folder, it treats the space where it has resided as empty and may write something in this place.  If this happened, the file/folder and its parameters may be detected correctly, but its data may be lost.

Folder names like $$$Folder58448 on NTFS partitions mean that the folder has not been found on the drive but some references to it have been. For example, folders 'My documents', 'Work', 'Photos' have been found and all they have one parent folder, whose description has not actually been found on the disk, so its name is unknown and therefore represented as $$$Folder58448. It may happen that the description of such folders was outside of the scan area, so try to enlarge the region or scan the entire hard drive. If that does not help, most likely that the description of the folder has been overwritten.

Folder names like $ROOT58448 on FAT partitions mean that some folders have been found, but they cannot be included into the folder structure for this FAT partition. Sometimes, such folders may contain other folder structures.

If you restore a file, and it appears that the file contains wrong data, try to do the following:

the logical disk, if the file has been just deleted.

the hard drive, if the data structure is damaged more seriously.

If there are several deleted files to be restored, you should use a file larger than 2KB to select the required partition.