Fragmented file processing
Previous Topic  Next Topic 


When the Process Fragments option is enabled, once the disk has been scanned, the option box below will be displayed. This will run automatic data carving routines.



The box indicates the number and type of files that could be processed.  ie it will try and determine the location of each fragment of the file, and reconstruct the file.  This process has a variable success rate, and can be slow, but will often reconstruct files that have otherwise been totally lost.


To assist in this operation there are two very critical values that need to be set which indicate the original size and location of clusters on the disk.  See the section on disk clusters for more details.  The example above is from a  small memory stick, and so a cluster size of 4 has been detected.  For most current hard drives, the most common cluster size is 32 or 64 ie 16K or 32K.


The option box above does have a link to the log which can be viewed to help assess the correct cluster sizes.  On a small disk the calculation of cluster size and offset is often correct.  On a large disk, and in particular one that has been heavily used, it is common to require manual setting of the cluster sizes.  It is often very useful to examine the file starts of the files to be processed, such as JPEGs.  If all such files always start with the same sector offset, and multiple of increment sizes, then this is the best value to use.