ReclaiMe Pro
all-in-one solution for many data recovery tasks

Search and Mark

When you click the Search and mark button in the Files and folders window, ReclaiMe Pro opens a new window where you can specify various search criteria. Take into account that when searching the recovered files and folders for specific objects, ReclaiMe Pro starts at the selected folder and then goes down the folder tree.

Mark multiple objects

There are several tabs where you can specify various search criteria.

File type, name, size Marking recovered data in ReclaiMe Pro.

Search mode

Using Search mode you can set which mask should be applied when searching the recovered data for an object with a specific name.

You can choose one of the following:

  • Substring search – ReclaiMe Pro searches for names containing the value typed into this field, not case sensitive.
  • MS-DOS * and ? mask, not case sensitive.
  • Regular expression, case sensitive.

Object type

Using the Object type parameter you can tell ReclaiMe Pro which objects you need: all, files, or folders.

Deleted status

You can choose one of the following: all, not deleted, or deleted only.

On filesystems where detection of deleted files is not available, search for deleted files matches nothing.

Additionally, you may specify minimum and maximum size for objects to search.

Timestamps Marking recovered data in ReclaiMe Pro.

You may specify timestamps like:

  • Created after,
  • Created before,
  • Modified after,
  • Modified before,
  • Accessed after,
  • Accessed before.

Note that when recovering data, it sometimes happens that creation and modification time of a particular file cannot be retrieved, so you should be careful when using a time mask.

File content

In ReclaiMe Pro, you can filter file content by:

  • File extension
  • Test status
  • Content type

Keep in mind that these search criteria make sense only when the Test files function was applied to the recovered file set.

Marking recovered data in ReclaiMe Pro. File extension

When checked, allows you to select between two modes:

  • File extension matches detected content type
  • File extension does not match detected content type

Generally, ReclaiMe Pro analyses the file in question trying to find out whether it can be a file of the declared extension (as taken from the file name). To do this ReclaiMe Pro uses special algorithms; however, all the file content is not tested. It should be noted that content type mismatch may happen for reasons other than intentional renaming, for example due to file content corruption.

Test status

When checked, allows you to search for files with certain test status. The following test status values are possible:

  • Not tested
  • Unknown
  • Good
  • Bad
  • Read errors
Content type

When checked, allows you to specify content type ReclaiMe Pro should search the file set for. When analyzing content type, ReclaiMe Pro considers the real file content rather than file extension.

Search by hash

In ReclaiMe Pro, you have a capability to search for the files matching the known MD5/SHA-1 hash values. This feature helps you both identify the known good files and suspected files.

Searching recovered data by SHA1/MD5 hashes in ReclaiMe Pro.

To identify the known good files you should load the file (use the Load hash file button) containing the hash values, for example from the National Software Reference Library offering to download the files with MD5 and SHA-1 hashes.

You can also load your own hash database file to search for the suspected files. Each line in a hash file should have the following format:

  • Hash value – 16 hexadecimal symbols for MD5 hash or 20 hexadecimal symbols for SHA-1.
  • Optional custom symbols, for example file name.

Once the hash file is loaded, ReclaiMe Pro informs you how many hash values were extracted from the file. Discarded lines shows the number of hashes which were not loaded for some reason, for example due to incorrect format.

Note that Search by hash should be used only when Test files which calculates hash values for the recovered files was applied in advance.

Action

The parameter is used to tell ReclaiMe Pro what to do with the objects that match the search, Mark or Unmark.

If you choose Mark, all the found objects will be marked while all the previously marked objects are not affected.

When you choose Unmark, all objects matching the search criteria (both marked in the previous searches and marked manually) will be unmarked.

We have a mailing list in which we talk about interesting cases we encounter and share some tips and tricks.