Copyright: Copy Right 1998-2002 QueTek Consulting Corporation


Actions menu
File menu commands

The File menu offers the following commands:

Search	Searches for files.
Browse	Selects path to output folder for recovered files.
Recover	Recovers files selected from the list of files.
Stop	Stops searching.
Properties	Displays properties of the file currently selected.
Exit	Quits File Scavenger


Options menu
Options menu commands

The Options menu offers the following commands:

Use Folder Names	Restores sub-folder (directory) structure. For example, if you are recovering files to the ‘‘d:\recover’‘ folder and the file to restore is ‘‘e:\dir1\file1.txt’‘, then the output file will be ‘‘d:\recover\dir1\file1.txt’‘.
Debug	Used only if instructed by our Technical Support staff.


Edit menu
Edit menu commands

The Edit menu offers the following commands:

Find (in this window)	Searches for a string in the list of files found. Searching will be performed on all columns.
Select All	Selects all files.
Invert Selection	Inverts selection status of files and folders.


View menu
View menu commands

The View menu offers the following commands:

Toolbar	Shows or hides the toolbar.
Status Bar	Shows or hides the status bar.
Arranges Files	In list view only, sorts file by a column such as Name, Size, etc.
Tree View or List View	Displays files and folders found as a folder tree or list.


Help menu
Help menu commands

The Help menu offers the following commands, which provide you assistance with this application:

Help Topics	Offers you an index to topics on which you can get help.
Licenses	Displays or edits licensing information. See Licensing and Technical Support
About File Scavenger	Displays File Scavenger version number and the copyright statement.


Search modes
Selecting Search Mode

Each search mode has been optimized to maximize the chance of finding files under certain conditions.

•	Normal Search is the best option under normal conditions where files have been deleted from the Recycle Bin, in a DOS command window, from a network share or from Windows Explorer with the SHIFT key held. It is also the fastest. The volume can be on a basic or dynamic disk. The volume can be a normal, mounted, spanned or striped volume (RAID) as long as it is still intact.

•	Exhaustive Search can be used when the volume has been reformatted or has become corrupt. In many cases, it can find files even though Normal Search has failed. As the name implies, Exhaustive Search scans every single sector of the volume and will take significantly longer. It displays any files that match the searching criteria regardless of their deletion status.

•	Defunct Volume Search scans an entire physical drive for files on volumes that no longer exist (hence the name defunct), including broken striped volumes (RAID 0 and 5 volumes) or broken hardware RAID disks. Note that normal striped volumes or hardware RAID disks can be scanned using the Normal Search mode. Defunct Volume Search is necessary in the following examples:

o	A striped volume has been compromised and is no longer readable by the Windows operating system. The individual member partitions that formed the volume, however, must still be available. For a striped volume with parity (RAID 5), one member partition may be missing. The data on the missing partition can be generated from parity information stored on the remaining partitions..

o	A hardware RAID has been compromised and can only be accessed as individual disks. For RAID 5, one disk can be missing. The data on the missing disk can be generated from parity information stored on the remaining disks.

Defunct Volume Search mode is the most time consuming and should only be used as the last resort.

There may be multiple volumes on one physical disk. Therefore when using Defunct Volume Search, there may be many interpretations as to the original location of a deleted file. As a result, multiple recovered copies of the file may be created. In such case the first copy will retain the original name. Subsequent files will have the designation (1), (2), etc. appended to the filename (e.g. “test(1).txt”. “test(2).txt”, etc.).


Licensing and Technical Support

Licensing

You can purchase Personal Use or Professional Use licenses online. Once you have a license, choose the Licenses command on the Help menu to unlock File Scavenger. Both license modes offer the same features. They differ only in where the program can be run as explained later in this section.

A Personal Use license can be used on a single computer.

A Personal Use license can be transferred from the original computer to a second computer in the following scenarios:

•	The original computer is being retired and replaced by the second computer.

•	The license is bought for the original computer for testing. The actual use is intended for the second computer.

The right to transfer a license is not intended to allow the license to be used as a floating license among multiple computers. A Personal Use license is sold to a single computer.

A Professional Use license is registered to a named individual and can be used by the individual on any computer. When you purchase a Professional Use license on our web site, you will obtain a license file that contains licensing information. Choose the Licenses command on the Help menu to display the Licensing Dialog. Then click the Read License File command button and browse to and select the license file to unlock File Scavenger.

A Professional Use license can be transferred to a second individual when the original licensee no longer intends to use the product, such as in the case of permanent change in job assignments. The right to transfer a license is not intended to allow a license to be shared among multiple users.

File Scavenger can be downloaded from our web site at http://www.quetek.com. A demo license is automatically available for testing purposes. This license allows up to 32 kilobytes of data to be recovered. When a file is larger then 32 kilobytes, the remaining of the output file will be truncated, making the recovered file unreadable in most cases. A full license can be bought online.

Technical Support

Personal Use licensees receive a 90-day period of technical support via electronic mail. Professional Use licensees receive one-year technical support from the date of purchase. Additional support after this period can be arranged by contacting our sales staff at sales@quetek.com.

Please send your technical questions or problems to help@quetek.com.  Most questions will be answered within one business day. We are open from 8AM to 5PM US Central Time (GMT–6), Monday through Friday. We observe standard US holidays including New Year’s Day, Easter, Memorial Day, Independence Day, Labor Day, Thanksgiving, day after Thanksgiving, Christmas Eve and Christmas Day.


Using File Scavenger
Using File Scavenger to Recover Files

Following these steps to recover files:

•	In the "Search for" box, either select a file type or type in a specific filename to search for. The pattern matching character "*" and directory paths can be part of the filename (for example, ‘’*.txt’’ or ‘’dir1\*.txt’’). Use ‘’*’’ to search for all files.

•	Select a Search Mode.

•	Select a volume where searching will take place. If the search mode is Defunct Volume Search, select a physical disk.

•	Click on the Search button. File Scavenger will start scanning the volume or physical drive. You can click stop at any time to abort.

•	Any files found will be displayed in the file list at the bottom half of the window.

•	Select the files you want to restore in the file list. Hold the SHIFT or CTRL key to select multiple files.

•	Specify the output folder (directory) where recovered data will be written to.

•	Click the Recover button to start recovery.


Determining the First Sector of a Volume

When using the Defunct Volume Search mode to scan a volume that is corrupt or has been deleted, you may need to specify the first sector of the lost volume. This section explains how to compute the first sector number.

•	On Windows 2000/XP run the Disk Management utility in Administrative Tools, Computer Management. On Windows NT, run the Disk Administrator.

•	Compute the size in sectors of the volumes preceding the volume or free disk space being recovered. (Divide the total volume size in bytes by 512, which is the number of bytes per sector).

•	Add up the sizes of the preceding volumes.

•	Because the first tract is reserved for the partition table, add to the sum above the number of sectors per track. This value can be obtained from the disk manufacturer but is usually 63.


Important information
Very Important Information

Please read this section carefully before proceeding.

Disclaimer

We cannot guarantee that recovered files still contain the original data. You must verify the integrity of the files by other means.

File Scavenger can recover files on NTFS volumes. FAT16 and FAT32 formats are presently not supported. (FAT formats are fragile and deleted files are usually permanently lost, except for unfragmented files where the entire file is stored in one contiguous group of disk sectors.)

Data is not immediately lost after a file is deleted. If the disk sectors occupied by the file have not been reused, the file is usually recoverable. However, the file will be permanently lost (wholly or partially) once the sectors are reused, such as in the following cases:

•	The system extends its internal housekeeping files or databases. This is possible if the volume being recovered is the system volume (which is usually the C volume) or contains the page file (which may be extended from time to time).

•	New software is installed. The installation process usually creates new files, thus permanently overwriting deleted files. This applies to the installation of File Scavenger as well. However, it is safe to install new software if the volume being recovered 1) is not the system volume, 2) does not contain the page file and 3) and does not contain the install directory.

•	The volume being recovered is updated by other users who log on locally to the computer or access it from the network.

•	The volume being recovered is updated by other applications.

You should take immediate actions to prevent permanent data loss. For example, it you have accidentally deleted files on volume D, you should:

•	Stop immediately any activities on your computer that may write to volume D.

•	Prevent other users from writing to the volume. Prohibit write access on any network shares on the volume. Stop any application servers that may write to the volume.

•	If the volume being recovered is not the system volume and does not contain the page file, install this utility on another volume (if it has not already been installed). Alternatively and more safely, you can download the floppy disk version of File Scavenger onto another computer, expand the zip file onto a floppy disk, insert the floppy disk on the computer being recovered and run File Scavenger from the floppy disk drive.

•	If the volume contains the Windows system folder or the page file, shutdown the computer immediately. System activities may overwrite the data. Remove the physical hard drive and install it on another computer to recover the data.

•	During recovery, never restore files to the same volume. Deleted data may be overwritten by the system when it allocates space for the recovered files.


Features
Features in File Scavenger Version 2.0

•	Recovers files deleted accidentally from a network share, the DOS command prompt, the Recycle Bin or from Windows Explorer bypassing the Recycled Bin (by holding the SHIFT key during deletion).

•	Recovers files on volumes accidentally reformatted. (Exhaustive Search Mode)

•	Recovers files on deleted volumes whose original size and location are not known. (Defunct Volume Search Mode)

•	Recovers data from broken or corrupt striped volumes (i.e. RAID 0 or RAID 5) if the individual component physical hard drives are still accessible and the original drive order in the striped volume and the blocking factor are known. In the case of a striped volume with parity (RAID 5), data can be recovered even if one hard drive is missing. (Defunct Volume Search Mode)

•	Recovers the original folder (directory) structure.

•	Supports for new NTFS features in Windows XP/2000 such as sparse files (i.e. files whose contents are mostly zeroes), alternate data streams, etc.

•	Recovers data from compressed volumes.

•	Provides a simple but powerful user interface.

•	Provides a drop-down list of registered file types for ease of selecting what files to search for.

•	Sorts files by name, type, size, date, etc.

•	Displays file as a list or tree.

•	Restores original Create and Modified file dates.

•	Provides a Unicode version for non-alphabet languages.

•	Supports both basic and dynamic disks.


Frequently Asked Questions

What do I do after files have been accidentally deleted?

See 	Very Important Information

What accounts can run this utility?

Only accounts with Administrators privileges on a Windows NT/2000/XP computer can run this utility.

Can I recover files deleted from the Recycle Bin? Files removed from network shares? Files deleted in the DOS command window? Files removed from Windows Explorer with the SHIFT key held?

In general, File Scavenger can recover files in all of the scenarios mentioned above.

•	Files deleted from the Recycle Bin can be recovered like any other files. However, if you have emptied the entire Recycle Bin (by choosing the Empty Recycle Bin command), some of the original filenames may have changed to DD1, DD2, DE1, DE2, etc. (where the second letter is the drive letter assigned to the volume). The file types will stay the same. Under this scenario, search for all files with the file type of the deleted file, recover and examine each of them individually to find the one you are looking for.

•	To recover files deleted from a network share, you need to log on to the file server where the network share resides.

•	Files deleted from the DOS command prompt or from Windows Explorer with the SHIFT key held can be recovered normally.

Can I recover files on a volume that has been accidentally reformatted or have been deleted?

In general, you should be able to recover all files on a reformatted volume by using the Exhaustive Search option. Sometimes, however, the original size and location of the lost volume cannot be determined. In that case you need to use the Defunct Volume Search mode

When should I use the Normal, Exhaustive or Defunct Volume Search mode?

See Selecting Search Modes.

What file formats does File Scavenger support?

File Scavenger supports the NTFS file format. Support for other formats is not being provided because of the low success rate due to the limitation of such formats.

Explain to me the different licensing modes. Are there any program features that are only available under the Professional Use license mode?

See Licensing and Technical Support. Both license modes offer the same program features.


Contact Us

QueTek Consulting Corporation

2650 Fountainview, Suite 122
Houston, TX 77057.

Toll-free for US and Canada Sales only: 1-866-722-0584

Phone: (713) 722 0584

Fax: (832) 251-9824

Technical Support: help@quetek.com

Email: help@quetek.com

Web Site: http://www.quetek.com


About File Scavenger
About File Scavenger Dialog

This window displays a copyright statement and current software version number.


Main window
File Scavenger Main Dialog

Search for:

Click on the drop-down list to select a file type, or enter a file name to search for.  The pattern-matching character “*” can be part of the filename. In Normal Search mode, a folder path can also be specified. For examples (only the strings within the quotes should be typed in the box, not the quotes themselves):

•	‘’*.txt’’: Searches for all files with file type “txt”.

•	‘’mydata\*.txt’’: Searches for all files with file type “.txt” in a folder named “mydata”. For example, if volume E: is being searched in the Normal Search mode, the following files will match the pattern: “e:\mydata\myfile1.txt”, “e:\Year2001\mydata\file2.txt”. (In Exhaustive and Defunct Volume search mode, the folder path will be ignored.)

•	“\mydata\*.txt”: for all files with file type “.txt” in a folder named “mydata” which is under the root directory of the volume. “e:\mydata\myfile1.txt” will match but “e:\Year2001\mydata\file2.txt” will not match. (Again, only under the Normal Search mode.)

•	‘’*’’: Searches for any files.

Search:

Click on this button to initiate a search.

Search Mode:

Select a Search Mode.

On Drive/Volume:

Select a volume or physical drive to perform the search.

Advanced:

This command allows you to locate a simple volume that no longer exists, or a striped volume (RAID 0 or 5) that has been broken or corrupt and is no longer accessible via Windows commands. (Note that you should use Normal or Exhaustive search mode rather than this option when scanning a working striped volume.) This command is only available in Defunct Volume Search Mode..

Output Folder:

Type in or use the Browse button to select a output folder to restore files.

Use Folder Names:

Also restore the original folder names. For example, if you are restoring files to the ‘‘d:\restore’‘ folder and the file to restore is ‘‘e:\dir1\file1.txt’‘, then the file will be restored to ‘‘d:\restore\dir1\file1.txt’‘. (If this is not checked, the restored file will be "d:\restore\file1.txt".)

Recover:

Click this button to start recovery.

File List:

Display information and attributes of files found and their recovery status.


License dialog
Licenses Dialog

Personal Use License:

Select this radio button if you are using a Personal Use license code.Licenses can be bought online at http://www.quetek.com. You will be asked to supply the serial number.

Professional Use License:

Select this option if you have already bought a Professional Use license code and have a license file.

Demo License:

Select this option if you do not have a license and wish to test the product. Recovery of data is limited to the first 32 kilobytes. For more details click here.


Search Range Dialog

You can specify a search range to skip over bad sectors or to reduce search time. Sector numbers are relative to the beginning of the volume. If not sure, click OK to search the entire range.

Search from Sector:

Specify the first sector number to search.

To Sector:

Specify the last sector number to search.


Error Dialog

Do not display further errors:

Suppresses any more error messages.


Debug Dialog

Use only under direction from our technical support staff.

Enter Debug File:

Enter the name of a file to save debug information.


Locate Defunct Simple Volume Dialog

This dialog helps you locate a volume on a disk that may have been deleted or are corrupt and cannot be read. File Scavenger will use this information to search for deleted files.

Physical Drive:

Select a physical drive on which the volume resides.

Partition:

Select a partition.

First Sector Number:

Specify the starting physical sector number of the volume. See Determining the First Sector of a Volume.If you are not sure, choose the default value which is the first sector of the second track. (The first track is reserved for the partition table.) File Scavenger may later help you determine the original position of the volume.

Last Sector Number:

Specify the ending physical sector number of the volume. This value can be computed by adding the first sector number and the size of the volume in sectors. If you are not sure, choose the default value which is the last sector of the physical disk.


Locate Deleted or Corrupt Volume Dialog

This dialog lets you specify a volume that is not accessible via normal Windows commands and utilities because the volume may have been deleted or damaged.  The information is only for the purpose of scanning the disk. This operation is completely *safe*. The disk configuration on your computer will *not* be changed in any way.

A Normal Volume:

Select this option if the volume is a normal volume.

Striped Volume:

Select this option if the volume was a striped volume but is no longer available because it may have been deleted or corrupt.

With Parity:

Select this option if the volume is a striped volume with parity (RAID 5).

Original Number of Disks:

Enter number of disks that form the striped volume. For RAID 0, each original disk must be available. For RAID 5, *one* disk can be missing.

Total Size:

Enter the size of the striped volume in megabytes.


Locate Defunct Striped Volume Dialog

This dialog lets you specify the configuration of a striped volume or hardware RAID that has been compromised and is no longer accessible via normal Windows utilities. For File Scavenger to reconstruct the data, you need to specify the member partitions of a striped volume or component disks of a hardware RAID. The partitions or disks have to be specified in the correct order. The order of the partitions or disks may not follow the disk numbers and trial-and error may be the only option. Note that you do not need to use this dialog in the following cases:

•	A striped volume or hardware RAID has been reformatted but is still accessible. Exhaustive Search Mode should be used.

•	A striped volume or hardware RAID has broken but has been recreated exactly like the original. Exhaustive Search Mode should be used.

Physical Disk:

Select a physical drive that contains a member partition in the striped volume. For a hardware RAID, select a component disk.

Partition:

Select a partition. This does not apply to hardware RAIDs.

First Sector Number:

Specify the first sector number. of the partition in the striped volume. For hardware RAIDs, this should be sector zero.

Add:

Add this partition to the set.

Remove:

Remove the highlighted partition from the set.

Member Partition or Disks:

Displays a list of partitions that form the volume in their original order (component disks for hardware RAIDs).

Move Up, Move Down:

Rearrange the order of partitions or disks by moving them up or down the list.


Striped Block Size dialog
Block Size Dialog

On striped volumes (with or without parity) or hardware RAID 0 and 5, data are written in stripes across all drives. You need to supply the size of a block in a stripe. Windows-based striped volumes have block sizes of 64 kilobytes. Hardware-based RAIDs may use a different block size and you may need to consult the manufacturer.

Striping Block Size:

Select a block size in kilobytes.


Find Dialog

This dialog lets you search for a string on the list of files found and displayed at the bottom half of the main dialog.

Find what

What string to look for. For example, one can look for a filename (whole or partial name), a specific file date or file type, etc.

Match whole word only

Ignore partial matches. For example, if you are searching for “test.doc”, “mytest.doc” will not match.

Match case

Consider casing. For example, “test.doc” will not match “Test.doc”.

Direction

Search forward or backward.


File Properties Dialog

This dialog displays the properties of the selected file.

Filename

The filename.

Folder

The folder where the file was in.

Modified date

The last modified date and time of the file.

Size

The size of the file.

MFT record number

The NTFS internal file record number of the file for tracing and debugging purposes.

MFT entry sector number

The position on disk of the file record.


Error Message dialog
Error Messages Dialog

This dialog displays error messages in a popup window during recovery.

Save to File

Save to a text file error messages displayed in the window.

Close

Close this dialog.