Search and Mark
When you click the Search and mark button in the
Files and folders window,
ReclaiMe Pro opens a new window where you can specify various search criteria.
Take into account that when searching the recovered files and folders for specific objects,
ReclaiMe Pro starts at the selected folder and then goes down the folder tree.
Mark multiple objects
There are several tabs where you can specify various search criteria.
File type, name, size
Search mode
Using Search mode you can set which mask should be applied when searching the recovered data for
an object with a specific name.
You can choose one of the following:
- Substring search — ReclaiMe Pro searches for names containing the value typed into this field, not case sensitive.
- MS-DOS * and ? mask, not case sensitive.
- Regular expression, case sensitive.
Object type
Using the Object type parameter you can tell ReclaiMe Pro which objects you need: all, files, or folders.
Deleted status
You can choose one of the following: all, not deleted, or deleted only.
On filesystems where detection of deleted files is not available, search for deleted files matches nothing.
Additionally, you may specify minimum and maximum size for objects to search.
Timestamps
You may specify timestamps like:
- Created after,
- Created before,
- Modified after,
- Modified before,
- Accessed after,
- Accessed before.
Note that when recovering data, it sometimes happens that creation and modification time of a particular file cannot be retrieved,
so you should be careful when using a time mask.
File content
In ReclaiMe Pro, you can filter file content by:
- File extension
- Test status
- Content type
Keep in mind that these search criteria make sense only when the Test files function was applied to the recovered file set.
File extension
When checked, allows you to select between two modes:
- File extension matches detected content type
- File extension does not match detected content type
Generally, ReclaiMe Pro analyses the file in question trying to find out whether it can be a file of the declared extension (as taken from the file name).
To do this ReclaiMe Pro uses special algorithms; however, all the file content is not tested.
It should be noted that content type mismatch may happen for reasons other than intentional renaming, for example due to file content corruption.
Test status
When checked, allows you to search for files with certain test status.
The following test status values are possible:
- Not tested
- Unknown
- Good
- Bad
- Read errors
Content type
When checked, allows you to specify content type ReclaiMe Pro should search the file set for.
When analyzing content type, ReclaiMe Pro considers the real file content rather than file extension.
Search by hash
In ReclaiMe Pro, you have a capability to search for the files matching the known MD5/SHA-1 hash values.
This feature helps you both identify the known good files and suspected files.
To identify the known good files you should load the file (use the Load hash file button) containing the hash values,
for example from the National Software Reference Library offering to download the files with MD5 and SHA-1 hashes.
You can also load your own hash database file to search for the suspected files. Each line in a hash file should have the following format:
- Hash value — 16 hexadecimal symbols for MD5 hash or 20 hexadecimal symbols for SHA-1.
- Optional custom symbols, for example file name.
Once the hash file is loaded, ReclaiMe Pro informs you how many hash values were extracted from the file.
Discarded lines shows the number of hashes which were not loaded for some reason, for example due to incorrect format.
Note that Search by hash should be used only when Test files which calculates hash values for the recovered files was applied in advance.
Action
The parameter is used to tell ReclaiMe Pro what to do with the objects that match the search, Mark or Unmark.
If you choose Mark, all the found objects will be marked while all the previously marked objects are not affected.
When you choose Unmark, all objects matching the search criteria (both marked in the previous searches and marked manually)
will be unmarked.