The media analysis function will give a brief analysis of the media, and allow for straight forward data recovery to made with just a few key clicks. A typical screen dump is shown below for a 30MB memory chip

Analysis

Once the required media, and type of media has been selected through the wizard, the media is analyzed to determine the best way to restore the data.

Stages of Analysis

Disk usage

The very first operation is to try and establish how much data there is on the media.  To do this 1000 sectors on the media are sampled to see if they contain data or not.  The number of sectors with data will then be shown as a percentage.  This will obviously include deleted and moved files, and so 100% may be seen, but it does not necessarilly mean that the media is totally full. A figure of 10% though does indicate a very empty peice of media.  The progress bar shows the progression of this.

Initial analysis

The next stage is to scan the drive directory to determine how many files can be found by logical means.  For a large disk this can take some time. The software does a scan of disk, trying to read the files logically, and try and work out how many sectors are actually used.  If the percentage read is much less than the number of used sectors, it will suggest that recover unallocated space should be enabled. This may not be required if the disk is known to be well used. If the amount to be trecovered is much less than expected, then recover unallocated space will assist.

Media Details

The media details displays several items of information about the media being examined

Operating system

This is the operating system detected on the media.  It may include types such a FAT16, NTFS, UDF.  If it states Unknown, the the type of disk can not be determined.  See the next section on how to proceed with unrecognised media.

The top part of the screen will fill in known details such as media type.  This could be UDF for a CD, or FAT32 for a hard drive.  The disk is then scanned to determine how many folders, files and deleted files are found when the disk is read conventionally. The number of image files are also determined and if a high percentage it may be assumed that. The media is from a camera, or a backup of photographs.

Based on the above information, the program will set the most likely parameters for a restore.  However, these parameters can be used in any combination and are described in detail below.

Recover good files

In this mode the media is read assuming that it is valid. Ie the root directory is processed, and all files extracted.  For multi session, or multiple partition, all sessions and partitions are read.

Recover deleted files

In this mode any file that has been marked as deleted is read. Depending on the operating system the integrity of the file may vary. Normally, if the file has just been deleted, the recovery will be good. For long files, there is a chance of fragmentation and this is difficult to recover on FAT operating systems, but NTFS, the fragments are retained.  If extra files have been written to the disk after ones have been deleted it is possible that the files will be overwritten.  The program will try and detect this, and the file will be marked in the log as partially overwritten. Technically, the file will be corrupted, but could be of use at times.

The restore deleted option has to be used with either Restore Good, or Restore from directory nodes.  Restored deleted files will be stored in a subdirectory with called  !deleted.

Recover unused space

Once files have been restored there is often areas of the disk that have not been accessed. In this mode all unread sectors are read, and where possible files are extracted.  This mode can also be used without reading any good files, and so the whole disk is read. This is particularly useful when the actual media has become logically corrupted, as sometimes does happen with camera memory chips

When the option is used in conjunction with Restore good files, or Restore from directory nodes, sectors that have been read will not be re-read.  If the option is used on it’s own, the whole disk will be scanned for possible files.

Files restored recovered from unused space will be stored in a subdirectory called !restore  and then a subdirectory for each type of file, eg exe, or jpg

Rescover from directory nodes

Restoring from directory nodes is used when the root directory is missing or corrupted.  The whole disk is scanned for possible directories on FAT disks, or MFTs on NTFS disks. Similar pointers are looked for on CDs and Zip disks

Photographic images only

This a mode that should be used when recovering files from a camera memory chip, or CD of just photographic images. Only files that are typically used for images will be restored.  These include JPGs, TIFF, NEF, BMPs.  This option only works in the Restore unused space mode.

Viewing the recovered files

On a full version of the CnW Recovery, once the files have been restored to the hard drive, they can be viewed using the standard applications.  However, the demo version does not save the files to the hard drive and so can only be viewed through the CnW application software. This is done by using the ‘View log.and files’ function button. This shows the list of files that could be restored from the media.  If a file is clicked on, it will then be displayed in a window.  For a image file, such as JPEG, or TIFF, it will be shown as an image, otherwise will be displayed optionally as a text or hex dump.

When restoring files, and afterwards, a window will display a thumbnail image of picture files it finds.  This will change every 5 seconds.  It is very useful for the demo program where files are not actually restored.