Table of Contents

8 Expert Features

The expert features are designed for technicians or experienced computer users to help recover data in more complex recovery scenarios. Enabling expert features from the Preferences will display two new available options: an Expert tab within Preferences and an Expert drop-down menu in the tool bar.

8.1 Expert Preferences

The Expert Preferences provide management settings for Data Rescue’s file modules. The Expert Preferences are separated into two additional tabs, Manage File Modules and Manage Conflicting File Modules.

Manage File Module Definition Files will list any file modules added into Data Rescue by FileIQ and allows you to enable, import or remove file modules. This tab is primarily used to import customized file modules passed from technical support in special case scenarios.

Manage Conflicting File Modules will list any file modules that have file patterns in common. Some file types may be mistaken for use with another program or another version of the program. Clicking on a listed file module will display any other file modules that were detected to have a similar file pattern. You may select a different file module to replace the current active file module to help ensure the file is found properly by Data Rescue.

Show Welcome screen at launch will always show the Welcome screen when Data Rescue starts up. Disable the checkbox if you prefer to not have this displayed and instead go directly to the Select Drive/Volume step.

Ask once per app session for the workspace will always ask for the workspace at least once per each app session (or launch). If you prefer for Data Rescue to remember the workspace and not ask unless necessary, uncheck this box.

The When quitting section has two drop down menus to note the default behavior of Data Rescue when exiting the application.

The first drop-down menu selects what to do with the scan results when quitting:

The second drop-down menu selects what to do with marked files from the Scan Results when quitting:

8.2 Expert Menu

The Expert menu is available on the menubar at the top of the screen.

8.2.1 Allocation Blocks Layout

Allocation Blocks Layout can be used after a Deep scan if the files listed by the Found Files results are not opening properly after recovery. If none of the files open when they are first recovered, selecting this feature will provide you with additional options which may correct the way the files are found.

During its scan, Data Rescue determines some possibilities for the proper Allocation Block Layout setup. The Block Size is the number of bytes of the allocation block. The Offset is the number of bytes (represented in hexadecimal), from the start of the media to the start of the file system.

The first choice is the default selection that Data Rescue considered to provide the best results, but if the files are not recovered properly, try each of the other selections.

To find the best allocation block layout for recovering files:

  1. Complete a Deep scan on the hard drive.
  2. At the results window, select a basic file (such as a JPEG image or text document) from the Found Files folder.
  3. Click on Preview to view the file.
  4. If the file preview does not properly show the file, go to the Expert menu and click on Allocation Block Layout.
  5. Click on the next available selection inside the Allocation Block Layout window.
  6. Click on the results window.
  7. Select the same file and click on Preview to view the file. If the file opens correctly, try previewing a few other files to ensure they are viewed properly also. If multiple files begin opening correctly, this is a good indication the right Allocation Block Layout was selected. The files can be selected and recovered at this point.
  8. If the files do not open in the Preview window, repeat steps 5 through 7 until the file is opened properly in Preview.

In some cases, such as a drive you scanned had more than one partition or if there are remnants of older file systems still present on the disk, you will find that some files require one Allocation Block Layout selection and other files will require a different selection.

8.2.2 Choose Drive/Volume for Scan

Choose Drive/Volume for Scan allows you to reselect the source hard drive or volume for any previous scan results in case the original hard drive or volume was renamed or detected incorrectly. Selecting this feature will provide you with a list of connected hard drives or volumes to reference as the source.

Choose Drive/Volume Window
Choose Drive/Volume Window

If the correct hard drive is already detected, it will be listed by itself in the window. However, if more than one volume is displayed, Data Rescue will compare the scan results to the selected media to detect the correct scanned media. A description below the list will state any potential issues if the wrong media is selected. The selected media which shows the least number of mismatched checksums and does not display any significant errors will be the ideal original source media.

Enable Show all drives and volumes to select any drive or volume, overriding Data Rescue’s filtered list based on the original drive/volume.

To reselect the drive/volume for scan:

  1. At “Step 3: Find and Select Files”, highlight the scan results you want to reload.
  2. Select Choose Drive/Volume for Scan.
  3. Select the drive/volume that closely represents the original media scanned. Ensure the description has the least number of mismatched checksums.
  4. Click OK.

Once the correct media is selected, you may continue with your recovery process from the results.

8.2.3 Show Details

Show Details gives a simple count of the number of potential file starting points found during a scan, organized by file type. The potential file starting points are not yet validated, so the ultimate number of files found by the end of the process will be less (sometimes dramatically less) than the number shown in the details window during the scan. The purpose of this window is to give the user an estimate of what kinds of files are being found during the scan.

8.2.4 Block Level Tools

Data Rescue features block-level tools to display raw disk blocks. Most users will not need this feature, but advanced users can use the block level tools to view absolute drive locations, such as viewing the partition table at the beginning of a drive or viewing the data at the start of a file.

To display a file’s block data:

  1. Highlight a file in the results window.
  2. Select New Window with this File’s Data/RSRC.

The Logical block read depends on the allocation blocks layout. If the displayed data appears incorrect, try a different allocation block layout. The Allocation Block Layout window automatically updates any open block display windows, so you can immediately see the effect of choosing a different Allocation Block Layout.

The standard block window shows only the start of the file that was highlighted when you open it. You can open a special “inspector” version of the block window by holding down the Option key while selecting New Window with this File’s Data. When opened in this way, the block display window will show the all block information for the selected file. This allows you to quickly look at the the different blocks of data for the file. If the displayed data appears incorrect, try one of the other Allocation Block Layout choices as described in the previous section.

New Window with Block # will display data at a specific block number on the hard drive.

To display a block number’s data:

  1. Select New Window with Block #.
  2. Enter the block number to view.
  3. A window will appear with the block’s data. Click on Next or Previous to proceed viewing the next block’s data.

8.2.5 Add File to Scan

Add File to Scan allows a file to be added to the Source list and enables the file to be scanned for any additional data that is a part of the file. This feature is especially helpful to help recover from damaged disk images that fail to mount.

To add a file to scan:

  1. At “Step 1: Select Drive or Volume”, select Add File to Scan.
  2. Browse the Open window and highlight the file you want to scan.
  3. Click on Open to add the file to the Source list.

Once the file has been added to the Source list, you may proceed with the standard steps to scan the file.

8.2.6 Set Drive/Volume Parameters

Set Drive/Volume Parameters is a feature that allows you to specify a starting and ending location and file system type for scanning. Using this feature manually sets parameters for the selected media. This is helpful if a hard drive’s partition table was erased or damaged, but the file system and block size are known to simulate the original partition.

Set Drive/Volume Parameters
Set Drive/Volume Parameters

Manually setting the hard drive / volume parameters requires technical knowledge of the media’s original settings to effectively utilize this feature.

There are several parameters that must be entered and selected:

The Revert Button will reset the values to the default information based on the media’s original settings.

To manually set the drive / volume parameters:

  1. At “Step 1: Select Drive or Volume”, highlight the hard drive or volume for which you want to change the parameters.
  2. Select Set Drive/Volume Parameters.
  3. Enter the Start Scan Block / Byte #.
  4. Select End or Length from the drop down menu.
  5. Enter the Scan End Block / Byte #.
  6. Select the File system from the drop down menu.
  7. Click on Set to apply the settings.

Once the parameters have been set, you may proceed with the standard steps to scan your hard drive.

8.2.7 Add RAID Set

Add RAID Set allows you to simulate a RAID configuration based on the RAID functionality built into Mac OS X. This is helpful in case an Apple RAID configuration fails to mount or be recognized as a single volume. Please note that Add RAID Set does not attempt to fix or repair a RAID set. Instead, the RAID set is configured through Data Rescue for the purpose of scanning for data.

Add RAID Set
Add RAID Set

Add RAID Set will not write any data to the hard drive, keeping the original state of the hard drives. This feature is specifically intended to help simulate Apple software RAID configurations. Data Rescue attempts to setup the RAID settings based on what it detects on the drives, so it may not be necessary to alter any settings when adding a RAID set.

To add a RAID set:

  1. At “Step 1: Select Drive or Volume”, hold the command key while clicking on the hard drives in the list that are associated with the RAID volume. This will highlight multiple hard drives.
  2. Select Add RAID Set. This selection will be active only if two or more hard drives are highlighted.
  3. In the Add RAID Set list, drag the items in the list to rearrange the order of the hard drives / volumes from first to last. Data Rescue will automatically configure the order of the drives, and set the stripe size and RAID type according to what it sees on the drives. Only manually change the order, RAID type and stripe size if you know them to be incorrect, or have tried a scan with them using Data Rescue’s determined configuration and it didn’t work.
  4. Select the RAID type and RAID Stripe Size. If you are not using a Striped RAID, leave the Stripe Size as 32KB.
  5. Click on Continue to add the RAID set.
  6. A new selection in the Source list will appear as “RAID SET”.

Once the RAID set has been added, it can be selected to scan for data. In some cases, data may not be opened properly when recovered if the hard drives are not arranged in the correct order.

If data is not being recovered properly from the RAID, we suggest the following steps to troubleshoot the issue:

Data Rescue supports 3 basic types of RAID, described very briefly below.

Stripe – This is also known as RAID-0. As data is read sequentially from the RAID set, it comes first from the first component drive until a stripe-sized amount has been read, then the next data comes from the second component drive, and so on, in round-robin fashion.

Mirror – This is also known as RAID-1. With this scheme, each of the drives is suppose to contain the exact same copy of data. This means that if you have an undamaged component drive, you should be able to just scan that to find your files (you will not need to create a RAID set).

Concatenated – This is not an official RAID level, but rather a way to make multiple hard drives appear as one big drive by concatenating them together. As data is read sequentially from the RAID set, it comes first from the first component drive, until the end of that drive is reached, then continues coming from the second component drive, and so on until the end of the last component drive.

The ordering of the component drives is mainly important for stripe and concatenated types. If this is wrong, the scan may find few or no good files. To alter the order, simply drag each drive in the list into its proper position.

This RAID Stripe Size relevant for the Stripe RAID type, but irrelevant for the other types. The default and most common value is 32KB.

8.2.8 Erase Drive/Volume

Erase Drive/Volume allows you to easily erase the selected drive or volume. This will only reformat the disk, not erase the contents of the disk. Drives are formatted as HFS+. If a volume is selected, only that volume will be reformatted. Otherwise, the entire drive is reformatted and all existing volumes will be lost.

Table of Contents