(08) 6180 6959 [email protected]

Raw Data Recovery

by | Dec 1, 2021 | Data Recovery, Deleted Partitions, FAT filesystem, Raw Recovery

I spoke previously about the fat file system and how primarily it’s used with flash drives , camera memory cards and micro sd cards in phones see here. Today  I want to talk about the need for raw data recovery on the above media where the fat file system has become corrupted and your files are not displayed. It’s easy to corrupt the fat file system if the 2 File allocation tables , which are at a fixed location at the start of the drive, have bad sectors . See image below
Raw Data Recovery from corrupt file system.
We then need to perform a raw data recovery which means scanning the data area of the drive in a linear fashion from the start of the drive to the end. During the raw recovery process the software tools I use  look for file signatures. A file signature is sequence of bytes at the start of the file which are identical for that particular file type ,eg a word document, and in addition we look for a sequence of bytes at or near the end of the file which are also identical.

Raw Recovery Software

There are 3 tools I prefer to use when performing raw data recoveries. R-Studio is my goto to tool for doing a raw recovery and you can view a complete list of File Types R-Studio can recover here. It is always a good idea to double check  your results and I use Active File Recovery for this purpose as it can sometimes produce better results especially with jpgs. Open source software Photorec is very handy when you need to find a particular raw/file camera image format or a more obscure video format. A complete list of file types Photorec can discover can be found here.  This tool has saved the day on numerous occasions and for an example see the following post

Creating Custom File Signatures

Occasionally I need to perform raw recoveries on media where the file type is not common and there is no built-in signature. So I will just talk about what is needed when this happens, R-Studio allows you to create your own signatures. I has it’s own built-in hex editors and tools to but I prefer to use a simple Hex Editor program and create the xml file R-Studio requires.  The picture below is from  a drafting package  called Chief Architect and we will create a signature that R-Studio can use.

 

Data Recovery Chief Architect Plan

The picture below is of 2 chief architect plans tiled horizontally in a hex editor and what we are looking for here is a signature that is common to all Chief Architect files somewhere near the start of the file.  In the image below we saw that there is a sequence of 16 bytes 48 bytes from the start of a plan file which are identical. You should examine more files than just 2 files but we will just examine 2 for today.

data recovery perth

In the picture below we see are 2 Chief Architect plan files only now  are looking for  a signature that is common to all Chief Architect files somewhere near the end of the file.  In the image below we saw that there is a sequence of 38 bytes from the end of a plan file which are identical.

Hex File Signatures for raw data recovery

The picture below is of an xml file which can be incorporated into R-Studio to be used by that program when performing a raw recovery and which will find chief architect plan files. See the following post for a successful recovery of Files using this method.

data recovery

For more info on our deleted file recovery services.

Some of our Reviews

REQUEST A QUOTE

Address

126 Whatley Crescent Maylands

call:(08) 6180 6959

126 Whatley Crescent

}

6 Days a week from 8:00am – 5:00pm

[email protected]