This option is used to read the media at a very basic level from which either

• a complete image of the media may be made,
• or files can be extracted based on recognizing the start of each file.

The image mode can either be as a copy of the disk for security reasons, or because the disk has a large number of sector errors.  If thee are a large number of sector errors, a disk image may be constructed in sections, with the ability to skip bad areas of the disk.  The file extraction tools are the same as recovering from any physical disk, with any operating system.

This mode of reading works on any type of disk, with any operating system. Good results will be obtained when the files are stored sequentially (ie not fragmented) and are of a known file type. For instance JPEG files, MP3 files are easy to detect, but a custom data base structure may not be recognized. This mode has the advantage that it will look at complete disk, and so may extract files that have been left on the disk even when the disk has been reformatted, and even changed in operating system. Although the program will try and detect the correct file extension, typically it will not extract the file name, though on some file types it will have a good guess, for instance the first filename in a Zip file will be used.

The displayed menu has a section where the media may be determined – which may help in calculating the correct size. The size of the scan – in sectors, may be entered by hand and this is typically used when one section of the media has become unreadable, for instance the start of the end of the media.  By default, the program will try and read the whole disk.

The options allow extracting files in different ways, including allowance for compressed, or partially compressed NTFS disks

Split on file starts – not selected

When this option is not selected, the program will produce a raw image of the disk or media.

The image file produces is a straight, or raw copy of the media.  It is possible to make a copy of part of the tape but the image file will always be produced to start from the start.  Blank sectors are inserted initialized with 5AH. If, for instance when the start of disk is corrupted, or unreadable, it is desired to start reading an image from block 10,000 the image file will be padded with 10,000 blank sectors.  It would also be possible at a later date to fill in sectors 5,000 to 6,000.  These features can assist in creating a disk image of a very badly damaged disk.  It may be possible to read the files in the normal way using this disk image and CnW Recovery software.

In this mode all file starts, and related options are disabled and ignored.

Split on file starts – enabled

This is the mode when each sector, or cluster is examined for possible file starts.  Files are then stored in the selected output directory, with each file type in a separate subdirectory.  File names are called recoveryxxx.eee  where xxx is a sequential number, and eee is the standard file extension for the file type detected, eg jpg, or doc.  On some files, a filename is added after the recovery  section, eg  recovery345.backup_data.zip

Split options

Split on blank disk.  This will treat blank sectors, ie those filled entirely with zeros as the end of a file. Some files do have data that is blanks, so this option should be used with caution.

Fragmented Files. This is a mode that will help process files that are fragmented.  Initially this is just JPEG files, the number of files to be processed intelligently will be increased

Image Files.  This option will only look for files such as found on a camera or photo CDs.  By using this option it is less likely to find a false file start that is actually just compressed data.

Video files.  This mode is designed for video CDs and DVDs using MPEG files.  The files will only be split when the time reference on a block goes backwards, ie a new section starts.  This very useful for physically corrupted DVDs with missing sectors.

For many video disks the problem is often that the first of the disk is not readable.  In these cases, reading should be started where the data starts, often about sector 13000 for 1.4GB mini DVDs.  The ‘Search for sector start’ function will locate this position, though it can take a few minutes.

Cluster modes

When the cluster mode is enabled, the program will only look for possible file starts at the start a logical cluster.  When there are 8 sectors to a cluster this means that it will only look every 8 sectors, and this will help reduce the number of false file starts.  The program will automatically set the location and size of the clusters, but these values can be overridden.  For NTFS disks that have been compressed, the test of NTFS compressed clusters will test each cluster to see if compressed.  If it has been compressed, the program will read 16 clusters and try and decompress the data.  On a non fragmented disk, the results will be good, but on a heavily fragmented disk, the results may be very variable. For more details on clusters see Disk Clusters

Raid Disks

When the Raid enable is selected, the image file will be produced in a striped format, allowing both sections of the raid to be logically placed. Full details see Raid Disks

Status

When doing a drive scan, status details are displayed.  This will include the sectors read, and sectors failed.  If the data is being split, it will also give the number of files discovered.  The progress bar at the bottom of the screen will also indicate how far through the disk has been scanned. It will be discovered that sometimes the system appears to be extremely slow, and this is normally related to a high number of bad sectors. Unfortunately, there are not many ways over this problem, but the following suggestions may assist.  It should be noted that it is always possible to cancel the copy, and the start again at the same location

• First suggestion is to cancel copy (but not current sector), and turn drive off.  Once cooled down it may be possible to start again at the same location
• The second suggestion is to skip a section of the disk.  Note where the copy has reached, and cancel copy.  Start copy again, but make the start sector a high value. Write to the same output file, and the program will pad the apparent gap with sectors filled with 05AH. At any time later, it is always possible to follow a similar procedure, and start again in the area that was giving problems

On an NTFS disk that is reading very slowly, it may be worth while after reading the first few MB, to start the image at the start of the MFTs.  This value is displayed in the Recover option menu for NTFS. Please read the next section on recovery methods

A curious observation of slow disk reading is that for some disks, it will sometimes suddenly speed up, and may even continue at high speed to the end of a disk. Patience can sometimes be rewarded with a lot of data, but at other times, no significant progress is made.