Filesystem Recovery

ReclaiMe Pro is a universal toolkit for recovering data almost from all filesystems ranging from Windows family filesystems, to Linux, and to MacOS. Additionally, taking into account the specifics of data recovery work, in ReclaiMe Pro there is a capability to select one of the three filesystem recovery modes. Also, data recovery technicians find the ability to specify one or several filesystems for recovery useful because they can save the recovery time.

Filesystem recovery in ReclaiMe Pro.

General filesystem recovery options

ReclaiMe Pro can scan filesystems in three modes:

  • Filesystem scan first, then deep scan, with pause (recommended),
  • Filesystem scan first, then deep scan, no pause,
  • Deep scan only.

In the first mode, ReclaiMe Pro first searches the device for the main filesystem metadata objects thus allowing immediate access to the files and folders. Once all these objects are processed, ReclaiMe Pro displays a message stating that the initial scan is complete, and then pauses the recovery. For example, in NTFS data recovery, the scan is paused immediately after the first complete MFT is processed. This is an approximate equivalent of opening a filesystem in R-Studio. At this moment you can investigate the reconstructed folder tree, estimate the recovery quality, and make a decision whether the deep scan is needed. This allows to reduce the filesystem recovery time in case of not too badly damaged filesystems. This feature is not available with FAT16 filesystem recovery.

In the Deep scan only mode, which should be used for severely damaged filesystems, ReclaiMe Pro scans the selected device from the beginning to the end.

Enable raw scanner (file carving)

When marked, ReclaiMe Pro creates a root folder named Other to which it puts all the found files that cannot be included into any filesystem. In Other folder, files are grouped according to their extensions. Typically, this folder does not contain any useful data. If you observe that Other folder contains more data than other root folders, it means that a filesystem is severely damaged and additional investigation is required. Consider disabling raw scanner if you are running low on memory or if there are more than 20 millions of files on the volume. Note that Enable raw scanner is marked by default.

The Configure RAW scanner button opens a window where you can either set default file formats to search for and add your own file types for carving. Read more about configuring raw scanner at this page.

Target filesystems

ReclaiMe Pro can recover data from: FAT16/32, NTFS both regular and data deduplication-enabled volumes, ReFS, exFAT, a brand-new APFS, HFS and HFS+, ext2/3/4, XFS, BTRFS, UFS (big-endian and little-endian versions), ZFS, and VMFS filesystems. Note that for complex filesystems like BTRFS, ZFS and VMFS you may need first to reassemble a volume. For more details please refer to the VMFS recovery page.

In ReclaiMe Pro, you can specify a particular filesystem or several filesystems simultaneously. In some cases selecting a particular filesystem may significantly reduce the recovery time and hardware load (CPU, memory, and so on). For those filesystems, which do not use Unicode to store file names, there is a possibility to specify a code page. For FAT and HFS, code pages of a computer running the filesystem recovery are preset, while for Linux filesystems the commonly used UTF-8 encoding is preset. Also, HFS filesystem requires the RAW carving option to be set.

Note that for NTFS filesystem there is an additional setting — Detect duplicate files — which is enabled by default. Consider disabling this setting if you are running low on memory.

For ext and XFS filesystems, there is one more setting controlling a trade-off between the recovery speed and the number of deleted files which can possibly be recovered.

  • No undelete — faster scan. Choose the option if you deal with a failure not related to deleted files, for example you need to recover data after an underlying RAID failure. This settings speeds up the initial filesystem analysis by the factor of 100.
  • Normal undelete — slower scan. Implements a typical scenario of ext recovery when ReclaiMe Pro scans all the filesystem metadata trying to find all the files for which metadata is still usable.
  • More undelete (ext2 and ext3 only). Choose the option when you are not satisfied with the regular ext recovery result. In this case ReclaiMe Pro, in addition to regular undelete methods, uses its own advanced undelete algorithms to extract as much data as possible although sacrificing the recovery speed. On ext4 filesystem, this setting does not allow to recover additional files, but the scan will still be slower.