Creating custom IntelliRAW rules

Defining  IntelliRAW rules for known file types

As a primary scan method, UFS Explorer analyzes the existing records of a file system, in which the data is stored, and rebuilds its structure in a virtual mode, determining the exact locations of the missing files and folders. However, when the file system-based recovery is not possible, for example, because of the loss or severe damage to its metadata, the software can scan the entire content of the drive/partition and identify non-fragmented files by their characteristic signatures – unique patterns that are present in files of a certain type. This approach is referred to as recovery by known content or raw recovery (IntelliRAW).

The set of built-in rules for this kind of recovery can be expanded with new file types and their corresponding signatures defined by the user. If enabled, the custom rules will be employed along with the standard ones during a scan and also for the quality indication of files in the scan results.

The software offers an embedded editor that makes it easy to create, view and edit custom IntelliRAW rules. The component can be launched using the "IntelliRAW rules" option from the "Tools" item in the main menu.

In the opened window, you will see the set of available rules, with the file extensions and types listed in the first two columns. If you need to work with files of a specific format that is not described there, you may define a rule for it manually.

In order to do that, you will have to discover the signatures of the given file type on the basis of multiple sample files. For this, you may use Hexadecimal Viewer or any other available means. As one may not always distinguish the valid file signatures from occasionally similar data patterns, try taking as many sample files as possible, preferably those that do not come from the same source, for example, video files produced by several recorders, or ones created with different settings.

Examine the content of sample files and find identical sequences, especially those located at the very beginning or close to the file’s end. They have to be as particularizing as possible for this type of files.

Also, determine the format of the analyzed content – whether it is "binary" or text-based. Use hexadecimal signatures for regular raw files and text patterns from the text data pane for text-based types.

Select the identified signature(s) and copy it (them) along with its (their) position(s).

In UFS Explorer, go to the "Tools" menu and choose the "IntelliRAW rules" item in it.

In the opened dialog, create a new rule by pressing the "New type" button.

Depending on the format of your files, opt for a "binary rule" or the one that will contain a text-like character sequence.

After that, define a file extension that will be assigned to the files of the respective custom type of files.

Next, specify a name for this type. It will also be used as a name for the folder to which such files are placed in the results of recovery by known content.

If your rule is text-based, you may select the encoding from the drop-down list next to the "Text format" property.

After that, press the "Add rule" button and paste the obtained signature into the field next to the "Value" property.

If the position of a binary signature is different from 0x0, provide it in the "Rule offset" field.

For a text-based rule, you may enable or disable case-sensitive search.

After you hit "OK", the defined signature will appear in the list.

If you have more than one signature, use the "Add rule" button again. The created list of signatures can be modified later with the help of the "View/Edit" and "Delete" buttons.

Having defined multiple signatures, use the "Rules logic" property to set up the "match" conditions for them: the rule may be applied when all of them are found or when at least one of them hits.

Click "OK", and the created rule will be added to the program’s IntelliRAW rules set as a "user-defined" type. It will be activated automatically.

After that, you may close the editor. The defined configuration will be preserved after the restart of the program. You may edit, disable or delete the custom rules anytime later by referring to this component.

Enabling the created rules for the use during a scan

When running a scan in UFS Explorer, at the "Recovery by content" step of parameters definition, tick off the option "Yes, I’m interested in the result of recovery by known content" and then put a check mark next to the option "I want to use my own data search rules".

Press "Manage rules", if you need to make any corrections to the set of rules.

After the scan is completed, the files found with the help of custom rules will be placed to the $Custom folder. They won’t have their original names, since such information cannot be recovered using this particular method. Also, it may provide mediocre results in case of highly fragmented content or in the absence of a clear signature at the end of the file.