User manual: UFS Explorer Professional Recovery

1. The basics

1.1 Overview

UFS Explorer Professional Recovery was developed to meet even the most challenging requirements of data recovery specialists. Featuring versatile data recovery techniques, the software will restore lost files from a vast variety of storage media – from portable devices to complex RAID-systems and virtual machines – as well as various file systems. At the same time, in response to the abundant market of operating systems, there are software releases for Windows, Linux and macOS. The program will work with both desktop and mobile, distributed and centralized, real and virtual environments. The utility is intended to produce remarkable recovery performance when dealing with data loss cases of any complexity – from simple file deletion to data recovery after complete destruction of a file system.

With abundance of tools and functions organized into one efficient software, this application will become an irreplaceable assistant of specialists in the field of data recovery.

1.2 Specifications and requirements

Supported host operating systems:

• Microsoft Windows ®: starting from Windows ® XP with Service Pack 3 and later;
• Apple macOS: all versions starting from 10.15;
• Linux: Debian Linux 6.0 (or compatible) and above.

Supported host computer architectures:

• Intel Architecture, 32-bit (IA-32, x86) - for all operating systems;
• AMD64 (x86-64) - for all operating systems.

File systems supported for recovery:

• NTFS: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files, recovery after format and recovery after file system damage, support of volumes with enabled deduplication.
• FAT/FAT32: full support: data access, search for lost partitions, recovery of deleted files, recovery after format and recovery after file system damage.
• ReFS/ReFS3: full support: data access, search for lost partitions, recovery of deleted files, recovery after format and recovery after file system damage, support of volumes with enabled deduplication.
• SGI XFS: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files, recovery after format, recovery after file system damage; support of NAS devices and custom servers.
• Apple HFS+: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files and recovery after file system damage.
• Apple APFS: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files and recovery after file system damage.
• Linux JFS (JFS2): full support: data access, search for lost partitions, RAID recovery, recovery of deleted files, recovery after format and recovery after file system damage.
• Ext2-Ext4: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files, recovery after file system damage; support of both NAS and custom servers.
• ReiserFS: full support: data access, search for lost partitions, RAID recovery, recovery of deleted files, recovery after format and recovery after file system damage.
• UFS/UFS2, Adaptec UFS: data access, search for lost partitions, RAID recovery for both little-endian and big-endian variations; recovery after file system damage, very limited support of recovery of deleted files.
• Sun ZFS: data access and support of data recovery from simple and stripe ZPOOL, limited support of lost data recovery. Support of RAID-Z (RAID-Z2, RAID-Z3).
• Btrfs: data access and RAID recovery; support of harware RAID, madadm RAID, Btrfs-driven RAID.
• Novell NWFS: only data access and RAID recovery (copying files and folders from the NWFS file system).
• Novell NSS: only data access and RAID recovery (copying files and folders from Novel Storage Services).
• HFS: data access only (copying files and folders from the HFS file system).
• VMware VMFS: support of RAID recovery, data access, very limited support of virtual disk recovery.

RAID support:

• Supported are most popular standard RAID patterns for RAID0, RAID 1E, RAID 3, RAID 5, RAID 6, RAID 7, etc.
• RAID-on-RAID support: RAID 10, RAID 50, RAID 60, RAID 50E, etc.
• Support of custom RAID layouts via RAID Definition Language or Runtime VIM.
• Support of Drobo BeyondRAID and Synology HybridRAID.
• Automatic reconstruction of spanned volumes: mdadm, LVM, Apple Software RAID, Core Storage, Intel Matrix, Windows Dynamic disks, MS Storage Spaces

1.3 Features

• Work with devices implementing specific storage technologies
• Decryption of encrypted volumes
• Data recovery from RAID and RAID-based devices
• Flexible RAID Builder with an integrated script handler
• Support of disk images and virtual disks
• Automatic assembly of spanned volumes
• Data consistency analysis and error correction
• Instant evaluation of the file system state
• Immediate access to data of consistent file systems
• Automatic detection and manual definition of lost partitions
• Filtering of recovery results by custom criteria
• Saving scan results for further references
• On-the-spot disk image creation

Installation

2.1 Setup

The software download page is located at ufsexplorer.com/ufs-explorer-professional-recovery. This page also contains references to the information about software updates, technical details, including program specifications.

To install a new copy of the software or update the software from a previous version you should follow the steps of fresh software installation. If you are updating the software from an older major software version (e.g. from 4.x to 7.x or 5.x to 7.x), it's recommended to uninstall the older software version before installing the latest one. Other UFS Explorer editions can be installed together with UFS Explorer Professional Recovery.

For Windows users

You can install the software on Windows XP with Service Pack 3 and all later versions of the Windows operating system. It is also possible to run the software on older versions of Windows starting from Windows NT 4 with Service Pack 6 while software installation on Windows 95/98/МЕ is not supported at all. To install the software simply download the executable file of the software installer and run it.

Warning: never download or install the software on the drive which contains the lost data you are going to recover. This may lead to its permanent damage or loss. If the data was lost from a non-system partition, it's recommended to download and install the software on the system partition. If the data was lost from the system partition, it's recommended to shut down the computer immediately and boot it using UFS Explorer Backup and Emergency Recovery CD.

Having started the installation process, you will be prompted to choose the language of the user interface which will be used as the language of both the software installer and user manual. If the software is updated from a previous version, the installer will automatically pick previous language preferences. After that, the installer will show you the End User License Agreement (EULA) for acceptance. You will be able to continue the installation procedure only after EULA is accepted. At the next step, the software will prompt for the target folder to which the application will be installed. In case of a software update from a previous version, the folder of the previous software version will be set as the installation folder by default.

Then the installer will prompt for the name of the "Start" menu product group (the default one is "UFS Explorer"). At this stage the installer finishes collecting necessary information and starts the installation process. After it is completed, you will be able to run the software from the final window of the software installation wizard. You may also start the software using its shortcut in the "Start" menu ('All programs', then the software group (the default one is "UFS Explorer") and then "UFS Explorer Professional Recovery".

For macOS users

Download the compressed DMG-image file from the software web site and open it using Finder. As an option, you may copy the software to the "Programs" folder.

Warning: never download or install the software on the drive which contains the lost data you are going to recover. This may lead to its permanent damage or loss. If the data was lost from a non-system partition, it's recommended to download and install the software on the system partition. If the data was lost from the system partition, it's recommended to shut down the computer immediately and boot it using UFS Explorer Backup and Emergency Recovery CD.

For Linux users

Download the software binary archive from the web site (for example, into the "Downloads" folder) and extract its contents. Open the folder in the Terminal application and open the folder with binaries using the "cd" command (e.g. "cd ~/Downloads"). Run the "install" script as a local Administrator (e.g. "sudo ./*.install" or "su root -c ./*.install", where "*.install" is the name of the installation file – "ufs-explorer-pro.install" for UFS Explorer Professional Recovery).

Warning: never download or install the software on the drive which contains the lost data you are going to recover. This may lead to its permanent damage or loss. If the data was lost from a non-system partition, it's recommended to download and install the software on the system partition. If the data was lost from the system partition, it's recommended to shut down the computer immediately and boot it using UFS Explorer Backup and Emergency Recovery CD.

To start the software, you may use a shortcut in the Window Manager main menu (under "System utilities"). If you are going to run the software as a local administrator, you may type the application start command.

In GNOME:

press Alt+F2 to invoke the "Start application" dialog;

type "bash -c "xhost +local: && sudo \"/usr/lib/ufs-explorer/ufs-explorer-pro\""".

In Terminal:

type "sudo /usr/lib/ufs-explorer/ufs-explorer-pro" or "su root -c /usr/lib/ufs-explorer/ufs-explorer-pro"

2.2 Activation

Activation of the program means purchasing a license for the full software version and its registration. For more information concerning the difference between the trial/evaluation version and the full one, go to the 4.2 Licensing Information section. You can choose between two license types, depending on the purpose of the software employment: Corporate and Commercial licenses are available, each having special conditions of the product usage. Having purchased a license, you will get a sequence of symbols, which will be sent to the e-mail address provided in the purchase form.

After that, you should run the application (if it hasn't been started yet) and press the "Software Activation and License" button in the upper right corner of the interface

Paste the obtained sequence of symbols in the field "Registration Code" and fill in the field "Registration Name" which is to coincide with the name specified as a buyer in the payment document.

When the valid data is supplied, the software should switch to the "Registered" mode and immediately remove the trial limitations.

If you have problems with software activation:

• make sure you are using the correct software version and edition;
• make sure that the operating system platform is valid for registration (different OS platforms require different software licenses);
• make sure the registration code is copied as described above

2.3 Updates

The program itself may notify you about the availability of an updated version, which will be downloaded and installed after you press the "Install" button. You may also go to sysdevlabs.com/store, download the upgraded installation package of the needed software and simply run it as described in the Setup section. You will not need to enter the registration code again, if you have one, as the application remembers it. In case your software version is up-to-date, the installation manager will show the corresponding message.

2.4 Uninstallation

In case the software is no longer needed and you are willing to uninstall it, follow these steps:

• For Windows users: use the standard "Uninstall" feature under "Programs and Components" of Windows Control Panel. The software name for removal is "UFS Explorer Professional Recovery".
• For macOS users: simply delete the software from the disk.
• For Linux users: to remove the software run the SDL Software Manager as an administrator and uninstall the needed application. To do this open terminal and type "sudo /usr/bin/sdlsoftmgr" or "su root -c /usr/bin/sdlsoftmgr").

3. Use of UFS Explorer Professional Recovery

3.1 Introduction

As has already been mentioned in sections 1.1 Overview and 1.3 Features, this application is a professional tool intended to be utilized by specialists in the field data recovery to restore data lost from various devices due accidental deletion, formatting, file system damage after hardware or software failures, etc. The software contains instruments for data analysis and its manual modification which means that incorrect actions taken while using the software may lead to permanent data loss. In this section the peculiarities of software usage are described and illustrated with examples. If you have questions concerning the implementation of certain procedures, please refer to the Appendix section to check whether the question has already been answered there.

3.2 Software settings

Right after its launch, the program is ready for use with the most optimal default settings. However, the user can modify these settings for more efficient software utilization in the "Settings" tab opened with the "Settings" button in the upper right corner of the interface.

Each value can be changed by pressing the "Change value" button next to it. All the defined settings will be stored in the corresponding user profile folder in a special "ufsx" file. The software will not save any data to the operating system registry or configuration files (except uninstallation information, if applicable).

3.2.1 Temporary files path

This setting defines the target folder for the "View" tool of Explorer. The software will save all temporary files to this folder. More information can be found in the description of Explorer. The changes will be applied immediately.

3.2.2 Language

This setting allows changing the language of the user interface. For the change to take effect, the software should be restarted.

3.2.3. Zoom user interface

This setting allows increasing the scale of the user interface in order to adapt it to high-resolution screens. For the change to take effect, the software should be restarted.

3.2.4. Hexadecimal viewer

The settings included into this section define the default encoding in which symbolic byte representation in Hexadecimal Viewer is displayed, the maximum number of bytes copied via the system clipboard and the maximum number of bytes used for "undo" in Hexadecimal Editor.

3.2.5 Explorer

The settings avaliable in this section establish the maximum number of objects presented on a single "page" of Explorer and the maximum number of search results returned by a single search operation. Lower values will save memory and increase speed while higher values will allow manipulating more objects. The recommended values can be found in the hint section: to see them, select the header of the corresponding field. The changes will be applied to all the subsequent related operations. In addition, it is possible to set up the default action for the "View" tool: the actions include opening in the internal viewer or copying the file to the temporary files folder and launching it using the default associated application.

3.2.6 Files recovery (copying)

This section contains all the necessary settings related to the process of copying recovered files: the default action taken in case of presence of duplicate files, whether such conflicts will be logged by the software, what will be done if a file or folder cannot be created at the specified target location, in which format recovered encrypted NTFS (EFS) files will be saved and whether extended attributes will be recovered (for HFS+).

3.2.7 RAID defaults

This section includes settings in regard to reading and assembly of RAID sets: whether the software will detect attached RAID and try assembling known configurations automatically, update incomplete RAID when the missing constituent is detected or attempt to read RAID asynchronously when it is possible.

3.3 Operations

On startup the main window of the program is displayed, which includes the main menu (found near the top), the storages navigation tree (a pane on the left side of the interface) and the workspace (main program area positioned to the right). By default, the workspace will show the "Storage properties" tab which includes various information about the connected storages: for physical disks – type, name, capacity, number of sectors, ID, storage geometry, for logical disks – start/end, number of sectors, capacity and various file system properties and extra recognized technologies in addition to the above mentioned information about the physical storage it belongs to. This tab may also be opened with the help of the "View properties" tool from the toolbar above the navigation tree or the storage context menu option.

To get access to the content of a storage, activate the required disk partition in the storages navigation tree or choose the "Explore file system" option in its context menu. The software will display the "Explorer" tab for the chosen file system in the workspace. Using explorer-style navigation you may navigate to a specific folder, find and select the required files using the "Define permanent selection" tool and save them using the "Save selection" tool from the "Explorer" tab toolbar or using the "Save this object to..." context menu option for each of the files.

Any file can be also "opened" after its activation with a keyboard or mouse. This will either copy the file to the folder located at the "Temporary files path" and open it with the default associated program installed on your computer or open it in the internal viewer in a new tab depending on the preferences specified in the software settings.

3.3.1 Storages navigation

The tree includes two major containers: "Logical disks" which holds all available logical volumes and "Connected storages" which lists all connected physical devices, disk images, complex storages and spanned volumes.

Storages operations

The "Open" item in the main menu contains three subitems, using which you can manually open a disk image or virtual disk, a disk image of chunk files or a block device by specifying its full path.

The "Virtual disk or disk image" subitem allows opening any supported disk image or virtual disk file. In addition, it can also be used to open a previously saved RAID configuration and Runtime Software Virtual Image files (*.vim-files).

The "The disk image of chunk files" subitem allows spanning several disk image files and may be useful in cases, when a single disk image is split into several parts, for instance, because its size is very large.

The "Device by name" subitem allows opening a physical storage by specifying its OS-specific device name. In Microsoft Windows, you may open a volume by supplying its mount point (e.g. "E:"). To access physical drives you have to run the software as a local administrator.

The storages opened in UFS Explorer can be closed with the help of the "Close storage" tool from the toolbar above the storages navigation tree or the "Close storage" option from the storage context menu.

The "Refresh" item from the main menu resets the tree of attached storages: the list of attached storages gets updated and will include all detected storages, even the ones which have been previously closed (except for closed disk images and manually assembled RAID). This operation does not apply to the tabs which have already been opened in UFS Explorer: a storage is closed after the last tab related to this storage is closed.

In case OS used software RAID, it will be displayed as a set of its components. To open such RAID use the "Device by name" subitem of the "Open" menu item the and open the RAID by specifying the device name or mount point (such as "E:" under Windows or "/dev/lvm/vg0" under Linux).

Disk partitions

A single physical disk may be divided into several partitions. The purpose of this subdivision is data isolation (from other data or OS), installation of different operating systems on the same physical drive, etc.

The software will show disk partitions under the corresponding "drive" element (including those with unknown or unsupported file systems). The name of a partition reflects the type of a file system applied on it or the implemented storage technology. The start sector and the total size are specified next to each disk partition. More details about a partition can be found in the storage properties tab.

The file system icon will indicate its condition: a green icon means the file system can be accessed, the yellow one may signal problems, the red one states that there are problems and the gray one means the file system cannot be recognized. The padlock icon means that the volume is encrypted while the applied extra storage technologies also have their special icons.

The software does not display any information about the mount point of the file system. For example, drive "C:" may be displayed simply as an NTFS partition of a particular size.

A volume can be identified by the disk it belongs to, size, type or file system as well as by its files/folders content.

After a partition is activated, the software opens its file system in a new "Explorer" tab.

Creating a disk image

If a disk seems to have defects, it's strongly recommended to create its image and carry out further data recovery using this disk image file.

UFS Explorer allows creating a bit-to-bit disk image file of a storage using a special tool from the toolbar located above the storages navigation tree or the context menu option. For this select the needed disk and choose the "Save disk image file" tool or left-click on the storage and choose the corresponding context menu option. The tool makes it possible to save a partial disk image by defining a data range in sectors.

A partial disk image can also be created with the help of Hexadecimal Viewer. For this choose the "View hexadecimal contents" context menu option (or the tool from the toolbar with the same name), select a specific storage range, press the "Save contents as" button and when prompted, choose to save "current selection only".

A full disk image may be opened in the software using the "Virtual disk or disk image" subitem from the "Open" menu item while partial disk images may be put together with the help of the "Disk image of chunk files" menu option.

Defining missing partitions

The software allows defining a missing partition both manually and by automated scan. To open the "Partitions" tab for any physical disk, simply double-click this disk or select it and choose the "Manage partitions" tool from the toolbar above the storages navigation tree. The tools for work with partitions will be available in the toolbar of the "Partitions" section.

The "Partitions" section is synchronized with the Hexadecimal Viewer element: when a new partition defined by default is analyzed, the current position in Hexadecimal Viewer is used; when a disk partition is selected, Hexadecimal Viewer will navigate to the partition start location on the disk.

To define a partition manually use the "Define region manually by specifying range" tool from the "Partitions" tab toolbar. Prior to that you may find the partition in Hexadecimal Viewer; in this case the software may detect partition parameters (such as start, size, file system type) automatically, if this information can be recognized by the software.

Automated search for lost partitions is available through the "Search undetected partitions by metadata" tool. If you have started a new scan, you should specify a disk range to be analyzed and the file system types to scan for. If the file system is detected, the software will automatically add the disk partition to the list of disk partitions and the partition item under the drive in the left storages navigation pane.

The list of partitions can be saved and restored later using the "Save list to a file"/"Load list from a file" tools. It's recommended to save the list of partitions after successful scan to avoid repeated scan after software restart.

3.3.2 Using Explorer

The "Explorer" tab for the file system can be opened by double-click on a disk partition or with the help of the "Explore file system" storage context menu option.

If the software failed to recognize the file system, it will open Hexadecimal Viewer for this storage instead.

Files and folders in Explorer are represented as sorted lists containing the file/folder name, type, size and modification date. You may re-sort the list by clicking on the column header.

To simplify navigation Explorer contains a quick navigation panel with the support of navigation by navigation history, navigation to parent folders or by typing a full path.

The left side of the "Explorer" tab contains a tree of folders.

When a folder is activated, the software navigates to this folder. When a file is activated, depending on the preferences specified in the software settings, the program will either open it in the internal viewer or will copy it into the folder for temporary files and open using the associated installed application.

You can save files and folders to a specific "local" folder by selecting them and choosing the context menu option "Save this object to...".

You may select several objects in Explorer for copying by holding the "Shift" or "Ctrl" keys when selecting an object in the list.

If you need a more complex rule for copying files, use a "bulk copy" operation.

Explorer pages

If the number of files and folders exceeds the maximum number specified in the software settings, Explorer will use "Pages" to show all files. In the toolbar it activates the buttons for "Previous" and "Next" pages navigation and the button for navigation to a page by a given number.

To copy all data from such a folder you may either use a "bulk copy" operation or apply a copy operation for the parent folder.

Bulk copying

The option is activated by the "Define permanent selection" button of the Explorer toolbar. This turns both the list of files and the tree of folders to the "checkbox mode" so that you could select files and folders for copying.

The copying rule is defined as:

- a file or folder that was selected with a checkbox will be copied;

- if a checkbox was removed from the file, it will not be copied;

- if a folder is selected, it will be copied together with its content, except the deselected files and folders.

Having selected all required files/folders, press "Save selection" to start the copying operation. The selection can be canceled with the help of the "Cancel permanent selection" button.

Search for files and folders

The function is available as the "Quick find" field: just specify a sub-string of the file name in the search field. You may also use advanced search: the "Find files and folders" tool in the "Explorer" tab toolbar, the "Find files and folders" folder context menu or the "Ctrl+F" keys combination.

Quick search uses a string as a part of the file name and uses case sensitivity settings of the current file system.

For advanced search, you may specify a full mask for the file name (including the "wildcard" symbols * and ?). You may also define a rule for the file size and for inclusion of files and folders to the search result.

The search operation will start on a new "Search result" tab and runs over all sub-folders of the selected folder until all sub-folders are processed or the maximum number of found objects is reached.

New search will start on the same tab if the previous search operation is completed and the "Open on new tab" option is not specified.

You may navigate from the "Search results" tab to the "Explorer" tab by opening the folder containing the selected object. The software will not copy files/folders from the search results tab.

Data size

Before starting copying files and folders, it's recommended to evaluate whether the size of selected data matches the amount of free space available on the target storage. You may use the "Evaluate size and test" tool from the "Explorer" tab toolbar or the same option presented in the folder or objects group context menu.

The tool allows both evaluating the size of data and testing file system consistency. If a file system consistency error is detected, it's recommended to continue with file system recovery.

Folders tree panel

The panel contains the information about the currently opened partition, file system and folder for fast navigation. If a folder is chosen in the left panel, it will be opened in Explorer; this feature can be used for fast navigation through different folders.

The folder context menu contains all the tools available in Explorer for the folder record. If Explorer is in the "bulk copy" mode, you may select/deselect folders from the tree by double-clicking them.

3.3.3 Recovery of lost files

Search for lost file systems was described in the Defining missing partitions section. This section describes recovery of lost and deleted files (including recovery of user-deleted files, recovery after format, file system damage, etc.).

Recovery of lost files is available as the tools "Scan for lost data" in the toolbar above the storages navigation tree and the "Explorer" tab toolbar as well as an option in the partition context menu.

Recovery process

The "Scan for lost data" tool activates the "Recovery" tab used to specify or modify the parameters for the file system scan.

The tab consists of a settings pane, which includes various settings such as scan range, file system types to search for, file name encoding options, IntelliRAW management and the buttons for the start of recovery process or resuming a saved scan.

Search for file system variations is required if the file system configuration or type was changed and you want to recover the previous file system state. The tool allows defining file system types to search for and searches for their variants.

Example 1:an external FAT32-formatted drive containing some user data was re-formatted with NTFS; the goal is recovery of data that was stored on FAT32. By default, the software will show a record only for the NTFS file system. Choose "FAT" as a file system to scan for and run the scan. The software should detect the "FAT" variation and the scan can be aborted to run data recovery from the "FAT" file system.

Example 2: NAS Buffalo Terastation (4 х 1 TB) was configured as RAID0 for speed (the approximate size of the data partition is 3.8 TB), but after failure was recovered to factory default RAID 5 (the approximate size of the data partition is 2.7 TB). The address of clusters has been changed (the cluster address in XFS depends on the file system size). To recover files from the old state we should assemble RAID as RAID0, but the file system is still 2.7 TB (the new file system has overwritten the existing one). To find files and folders, first of all, the software must find the 3.8 TB file system variant. For this you should choose "SGI XFS" as a file system to scan, run the scan and wait until it detects the 3.8 TB XFS variant. After this you may abort the scan and run recovery of the just-found file system variation.

When all settings are specified, just press the "Start scan" button in the lower right corner of the "Recovery" tab.

The scan may take some time. After it is completed, the software will show the list of recovered volumes. To open a volume in Explorer, double-click it or select it in the list and press "Open selected item". To save it as a virtual file system file, which may be opened later with the help of the "Virtual disk or disk image" subitem of the "Open" item of the main menu, select it and use the "Save this item" button. To delete bad or unnecessary scan results, use the "Destroy this item" button.

A new "Explorer" tab for the scan result will have minor differences compared to the main Explorer interface.

Saving a scan result project

To prevent the loss of scan results caused by software or hardware failures, it's strongly recommended to save the scan result project so that you won't need to scan the storage once again which could make difference for large and slow storages. If you need to resume recovery after software restart, you will be able to simply load the scan result. This option is available from the partition context menu as "Load saved virtual file system". Such a scan result can also be opened with the help of the "Virtual disk or disk image" subitem of the "Open" item of the main menu. If the latter method is used, the software will search for a matching storage and will load the scan result as a virtual partition of the storage. If the storage was not found, the software attempts to restore it first by opening required disk images, assembled RAIDs, etc.

UFS Explorer Professional Recovery also allows pausing storage scan, saving it as a scan status database and resuming it later. To pause the scan press the "Pause scan" button in the lower left corner of the workspace and save it with the help of the "Save current state" button. To resume this scan, press the "Resume saved scan" at the bottom left of the "Recovery" tab.

Saving recovered files

Files that constitute a scan result can be browsed and copied just like those of an original file system. This means required files and folders can be saved with the help of the same tools available in Explorer

Important: never save recovered files to the source storage. The file data (content) for recovery is still being read from the source drive; this means the software may overwrite it. Use an additional storage for this purpose.

3.3.4 Disk-on-disk

The feature allows accessing files and folders on a virtual disk or disk image located in an inaccessible location without prior copying as though it was a "local" temporary disk image file. The supported situations include:

- virtual disks locked in a file system by running virtualization software;

- virtual disks on ESX(i) VMFS partitions;

- disk images or virtual disks stored on partitions unsupported by the host OS;

- disk images stored on file systems of disk images.

The level of nesting for the "disk-on-disk" feature is not limited.

To use the function, you must:

1. open the storage (e.g. a disk partition) in UFS Explorer;

2. find a virtual disk or disk image file;

3. select the file and choose the "Open files as disk image" tool.

The software will open the storage just like any other disk image file. If the disk image contains a supported file system, it will be detected. If the files stored within this image are disk images as well, they can be also opened with the help of the "Open file as disk image" tool. A disk-on-disk can also be used as a part of RAID; however, such a RAID configuration cannot be saved.

3.3.5 File data analysis

UFS Explorer Professional Recovery software not only allows finding lost data but also evaluating file system consistency and diagnosing logical causes which lead to data damage. The special tools for the analysis of file allocations are:

- the "Go to on-disk descriptor" tool in the "Explorer" tab toolbar the and the object context menu option allow finding the object descriptor and point it in Hexadecimal Viewer;

- the "Go to on-disk file start" tool in the "Explorer" tab toolbar the and the object context menu option point to the file/folder start on the partition;

- the "Open in hexadecimal viewer" tool in the "Explorer" tab toolbar the and the object context menu option allow opening the content of a file or folder in Hexadecimal Viewer for analysis;

- the "Show on-disk fragments" tool in the "Explorer" tab toolbar the and the object context menu option allow finding and navigating through fragments of a file or folder.

The set of available functions will depend on the file system type. The functions will allow diagnosing and resolving file system or storage logical issues by analyzing data allocation of files and folders.

3.3.6 RAID

UFS Explorer Professional Recovery fully implements all RAID recovery related functions, they do not require any prior activation and are also available in the trial version.

A specialized RAID Builder tool is available in the main menu of UFS Explorer Professional Recovery as "New RAID". It opens a new "New RAID" tab which consists of a toolbar, a list of RAID components and a sheet with RAID properties. The bottom of the tab presents the "Quick analysis" pane implemented as a context-dependent Hexadecimal Viewer.

Building RAID

UFS Explorer allows assembling any RAID configuration in the virtual mode for subsequent data access or recovery. To build RAID you should add all its components to the components list, set up RAID parameters and press the "Build this RAID" button from the toolbar. The assembled virtual RAID will appear among the connected storages in UFS Explorer. Reconstruction without a single drive is supported for RAID 5 and even without two drives – for RAID 6. Still, a virtual disk placeholder should be added instead of the missing constituent, so that RAID could be built correctly. For this use the "Add placeholder to indicate missing disk" button from the toolbar of the "New RAID" tab.

Note: An incorrect virtual RAID configuration assembled in UFS Explorer has no impact on the "real" RAID configuration, still, data recovery from such RAID is impossible. For successfull accomplishment of data recovery, you have to build RAID correctly. You may perform any number of RAID reconstruction attempts because UFS Explorer does not modify data on the source disks.

Adding a RAID component

All opened disks or disk images available in the left pane of the main window can be used as RAID components. When a new "New RAID" tab is opened and activated, the default behavior of the the storages navigation tree changes: activation of an item adds it to RAID as its component instead of opening the storage in Explorer. This also adds a new option "Add to RAID" to the disk or disk partition context menu.

Thus, to add a disk or disk partition to RAID as a component, simply "activate" it or use the "Add to RAID" context menu option. If you have added a wrong component, select it in the list and press the "Remove selected component" button from the "New RAID" tab toolbar.

To add a placeholder for a missing drive (only for degraded RAID 5 or RAID 6), press the "Add placeholder to indicate missing disk" button.

And finally, to modify the order of storage components, you may select an item and use the "Move component up"/"Move component down" buttons to set the correct ordinal position for the selected component.

If a storage component has an incorrect size or you should adjust the start position, use the "Edit component range" tool.

RAID parameters

You may use any source materials to find the correct RAID components (RAID board BIOS information, configuration files, on-disk structures, etc.). Anyway, you should specify the correct RAID parameters to recover intact data.

Different RAID levels use various settings. The properties sheet of RAID Builder adapts to the selected RAID level and allows specifying only the required RAID parameters.

For RAID 6 there are additional parameters (related to the redundancy algorithm and distribution) and they should be specified only in case RAID is reconstructed with missing (failed) drives.

Contextual data analysis

On-disk data of the selected component is displayed at the bottom of the "Hexadecimal Viewer" panel. This allows quickly analyzing the on-disk content and visually confirm the order of disks. Switching a component makes the software show the content of another component on the same position; Hexadecimal Viewer is also configured to allow for "tabulation jumps" of the size of a stripe specified for RAID.

Automated RAID reconstruction

Some RAID configurations can be recognized and assembled by the software in the automatic mode. If any of good components of such RAID is added, the software suggests building RAID automatically.

On success, the software loads RAID components in the right order and the full set of RAID properties.

In case of failure (e.g. in case of RAID configuration damage) you may cancel automatic RAID reconstruction and build RAID manually.

Result

In case of successful RAID reconstruction the array will be added as a new storage in the storages navigation tree. You may apply all the operations available for other storage types (including adding RAID as a component of another RAID) to this RAID.

Saving RAID

To save a RAID configuration, select it in the storages navigation tree in the left pane of UFS Explorer and use the context menu option "Save RAID configuration". You may load this configuration in the future using the "Virtual disk or disk image" subitem of the "Open" main menu item.

Correcting RAID configuration

To modify a RAID configuration, select the needed Virtual RAID storage it in the storages navigation tree of UFS Explorer and use the context menu option "Edit RAID configuration".

This will open a "RAID Builder" tab with pre-configured RAID components and RAID parameters. When this RAID is built, it replaces the original RAID in the storages navigation tree.

The tool is useful for changing (or guessing) RAID parameters after incorrect specification.

Compatibility with Runtime Software RAID configurations

RAID configurations in the format of Runtime Software .vim files (Virtual Image files) are supported by the software and can be imported using using the "Virtual disk or disk image" subitem of the "Open" item of the main menu.

Additionally, SysDev Laboratories implements several extensions to the .vim file format that can be not supported by Runtime Software products:

Full 64-bit support for all numeric parameters, including offsets and sizes.

Support of all disk image files and virtual disks (supported by UFS explorer) via .vim.

Support of .vim-files under Linux, macOS, BSD. This changes the format of the hard disk reference record and has format of "HD${path}", where ${path} is the full path to a block device (e.g. HD/dev/sda:).

User-defined RAID configurations

To apply a custom RAID configuration you should create a text file (ASCII or UTF-8/UTF-16 with a format marker) containing an instruction for the RAID configuration. RAID is configured via the "stripes" command which uses the "stripe size" and "pattern length" arguments. The command block describes the storage components in their order. The "comma" symbol delimits the components of the same row; the "semicolon" starts the description of the next row. An optional argument for the component defines the row "bias" of the component. The definition is not newline sensitive. It's allowed to add block comments /*...*/.

To load the created configuration files choose the „Custom data distribution algorithm" option from the drop-down list next to the RAID level parameter in the RAID properties sheet and press the „Change value" button next to the „Data distribution algorithm property". After successful import of the configuration the software displays the dialog for configuration confirmation. If the configuration seems correct, press OK to accept it. After this press the „Build" button in the „RAID Builder" tab to accomplish RAID assembly and open it as a RAID storage in UFS Explorer.

Example: RAID 5, Left Symmetric, 64KB stripe using 4 drives is defined as: stripes(128,4) {
1,2,3;
4,1,2;
3,4,1;
2,3,4;
}

Without newlines:

stripes(128,4) {1,2,3;4,1,2;3,4,1;2,3,4;}

Here "stripes(128,4)" – defines the configuration with the stripe size of 128 sectors and the pattern size of 4 stripes. Enumeration in {...}-block defines the ordinal number of components. Semicolon defines a new pattern row.

Using the bias argument you can write the same as: stripes(128,4) {1,2,3,4(1),1(1),2(1),3(2),4(2),1(3),2(4),3(4),4(4)}

Instead of a component you may also specify a functional expression. The supported expressions include "reconstruction by parity", "reconstruction by Reed-Solomon code" or "combined by parity and Reed-Solomon".

The formats of functional expressions: parity: P{1,2,3}. Here: P – parity function, enumeration – components used to calculate parity. Reed-Solomon: Q(5,g,4){1,2,3;1,2;3}. Here: Q – Reed-Solomon code, 5 – disk ordinal number, location of Q-stripe, g – index type, 4 – missing drive index; enumeration – disk numbers followed by disk indices (separated with semicolon) to calculate Reed-Solomon code.

a) Parity and Reed-Solomon: PQ(6,7,i,4,5) {1,2,3;1,2,3}. Here: PQ – combined calculation, 6 – P-stripe drive ordinal number, 7 – Q-stripe drive ordinal number, i – index type, 4 - disk index to reconstruct, 5 – disk index of the second missing drive; enumeration – disk numbers followed by disk indexes (separated with semicolon) to calculate Reed-Solomon code. Index type g – means two power of index in Galois field, i – just a simple index.

Samples of RAID configurations with reconstruction:

4 x RAID 5, Left Symmetric, 64 KB stripe, without drive 3:
a) stripes(128,4) {
1,2,P{1,2,3};
3,1,2;
P{1,2,3},3,1;
2,P{1,2,3},3;
}
b) 5 x RAID 6, Left Symmetric, 64KB stripe, without drive 3, redundancy order is P, then Q:
stripes(128,5) {
1,2,P{1,2,3,4};
4,1,2;
3,4,1;
P{1,3,4},3,4;
2,P{2,3,4},3;
}
c) 5 x RAID 6, Left Symmetric, 64KB stripe, without drives 3 and 5, redundancy is P, then Q:
stripes(128,5) {
1,2,P{1,2,3,4};
Q(3,g,1){1,2;2,3},1,2;
3,P{1,2,3},1;
PQ{1,2,g,1,3}{3;2},3,PQ{1,2,g,3,1}{3;2};
2,Q(1,g,2){2,3;1,3},3;
}

If RAID has "parity delay", you may specify "loop" to entire column including functional expressions using the "repeat" function. For example, 4 x RAID 5 Left Asymmetric, 16 KB stripe size and parity delay of 16 stripes:
stripes(32,64) {
repeat(16){1,2,3};
repeat(16){1,2,4};
repeat(16){1,3,4};
repeat(16){2,3,4};
}

Specifying disks

An optional "drives" section. If the section is not specified, RAID Builder will use the already defined components. If specified, the list of components from RDL will replace the list in RAID Builder. The supported types of components are: "disk" – a physical drive, "image" – a disk image file, "span" – a pre-defined span of components. A component is defined as a type (identification information, start offset, use size). The "start offset" and "use size" parameters are optional.

Example:

disk (1,2048,233432);

image(C:/image1.img,0,4096);

image(C:/image2.img);

span(myspan01,0,40960);

Physical drive identification information under Windows is the ordinal number of the drive; under macOS, Linux, etc. – the full path of the block device, for a disk image – the full path of this disk image, for span – its identification name.

Here is an example of full configuration for HP RAID with 4 x RAID 5 Left Asymmetric, 16 KB stripe size and parity delay of 16 stripes:

drives {
disk(1,1088);
disk(2,1088);
disk(3,1088);
disk(4,1088);
}

stripes(32,64) {
repeat(16){1,2,3};
repeat(16){1,2,4};
repeat(16){1,3,4};
repeat(16){2,3,4};
}

If a configuration contains only the "drives" section, it simply loads the components into RAID Builder without defining any RAID configuration.

Defining span

A span can be defined with the help of the "defspan" section. It must be defined before being used as a component. The syntax of the span definition is: defspan(name){enumeration}. Enumeration may include the same components as for the "drives" section (including spans).

Example:

defspan("myspan01") {

disk(1,2048,233432);

image("C:/image1.img",0,4096);

image("C:/image2.img");

span("myspan00",0,40960);

}

A simple span can be loaded via RDL using the following code:

defspan("images") {

image("C:/image1.img");

image("C:/image2.img");

image("C:/image3.img");

}

drives {

span("images");

}

stripes(1,1) {1}

3.3.7 Data modification

The software enables data modification directly on the source drives for correction of logical data structure defects. However, this also implies the risk of permanent data loss. Therefore, before using the data modification tools, you should be totally sure in your actions. Also, it is strongly recommended to save a backup copy of the source storage and work with this copy.

The editing functions are available for disks (including disk images and virtual disks) but not for RAID or files.

To enable the "edit mode" press the "Modify data" button in the "Hexadecimal Viewer" panel or use the "Edit contents" storage context menu option. This opens a new "Hexadecimal Editor" tab marked with a red icon. If Hexadecimal Editor is invoked from Hexadecimal Viewer, it will be configured to the same storage view position. Hexadecimal Editor supports all functions of Hexadecimal Viewer and is extended with data modification tools available in the bottom panel. Hexadecimal Editor also accepts data modification via the keyboard or data copying using the clipboard.

You can both paste (overwrite the storage content) using raw clipboard data or parse the clipboard contents as hexadecimal text (available though the "Paste as" tool).

Finally, there are tools for filling in data ranges or making more complex byte transformations.

If the amount of modifications does not exceed the undo tracking limit, all the modifications are performed in memory before an explicit "Save" command and they can be reversed. If there are too many modifications, the software will ask to save data to continue. If a single operation requires too much memory to fit the undo buffer, the operation can be performed directly on the storage without the possibility to undo it.

Example: To destroy all data on a disk partition open it for writing (the "Modify contents" context menu option); this will open Hexadecimal Editor. Review the data to make sure that the correct partition is selected. Select all the data using the "Ctrl+A" keys combination. Press the "Modify selection" button. Apply the action "Replace bytes" with 0 (the default action). Wait for completion.

3.3.8 Making "clones" of disks, virtual disks, RAID, etc.

The software allows creating a bit-to-bit copy of any supported storage on a hard disk.

To do this:

1. make sure that all tabs are closed to avoid incorrect selection;
2. open the source storage in Hexadecimal Viewer and check its contents;
3. open the target storage for writing (the "Modify contents" context menu option) and make sure there is no valuable data;
4. in Hexadecimal Editor opened for the target storage choose "Overwrite data with...";
5. in the dialog choose the source storage, its start position and the number of sectors to transfer;
6. start the process and wait for its completion.

The action cannot be undone.

4. Legal information

4.1 Copyright

UFS Explorer products are licensed, not sold. This means that the Software Legal Owner (SysDev Laboratories LLC) only grants you some rights for the software use. Please read the End User License Agreement for more information about software licensing.

The End User License Agreement is a Public Offer Agreement. Any use of the software (including copying, installation, exploitation, etc.) means you have accepted the Public Offer Agreement. From the moment of acceptance, the Agreement comes into legal force in most countries worldwide.

Only SysDev Laboratories LLC, the software Author and authorized resellers are authorized to issue Registration Codes for applications that are property of SysDev Laboratories LLC. Unauthorized use of a Registration Code is violation of the Ukrainian and international Copyright Laws.

Any publication of a Registration Code by a License Owner or unauthorized license transfer result in termination of the End User License Agreement.

The End User License Agreement is a Public Offer Contract that has legal force in Ukraine and other countries. By installing and using the software you accept this Public Offer. The violation of EULA can be considered as a crime in these countries.

4.2 Licensing information

UFS Explorer Professional Recovery is sold on the basis of the following licenses:

1. Trial/Evaluation License – the Software can be used by a single person for evaluation purposes only. A License Owner shall agree to the "trial limitations" of the Software.
2. Corporate License – the License is applicable for software use by a legal entity, company or organization on up to 10 (ten) computers owned by a License Owner for non-profit purposes. A License Owner is not authorized to provide any "for-profit" services using the Software or use it at home for personal purposes. The Software cannot be installed on computers of third parties (e.g. customers of a License Owner).
3. Commercial License – the License is applicable for software use by a legal entity, company or organization on one computer owned by a License Owner for commercial purposes. The Software cannot be installed on computers of third parties (e.g. customers of a License Owner).

The Corporate and Commercial licenses require the payment of the license fee. After the purchase of a Software License SysDev Laboratories authorizes it by issuing a Software Registration Code. This code is used to unlock the program functions (remove the "trial limitations") and identify a License Owner as an authorized owner of the Software.

A Corporate or Commercial License Registration Code is issued to either Company's name or Person's (entrepreneur) name and authorizes the Person/Company to use the application according to terms and conditions of EULA.

4.3 Contacts

Company details

Central Office:

Limited Liability Company SysDev Laboratories

Code of legal entity: 35951055

28-V Druzhby Narodiv Blvd,

Kyiv, 01103, Ukraine

E-mail: info@sysdevlabs.com

To contact our support team, please fill in the contact form.

5. Glossary

This section describes the main terms and notions necessary for understanding the peculiarities of work with the software.

5.1 RAID

RAID (Redundant Array of Independent Disks) is a special technology for data storage organization in which several separate disks are combined to constitute a single system. In such a system, in contrast to traditional linear storages, the data is distributed across the drives in a way typical for a certain RAID level. Each level has its advantages and disadvantages, but the main idea of any RAID is a balance between maximum performance, increased reliability and full capacity of useful storage space.

An operating system detects RAID as a single drive giving it its own mount point and treating all its disks as one storage. A RAID controller is responsible for correct operation of the system, which can be either hardware- or software-based.

Most commonly used RAID levels include:

- JBOD, which is not exactly RAID, as it doesn't feature redundancy or increased fault-tolerance. Generally, this is Just a Bunch of Disks (not necessarily of the same size) combined to consequently store data as the disks are filled one after another. This technique is also called disk spanning.

- RAID0 is based on data striping without redundancy. Each disk in the system is divided into separate segments – stripes. In the process of writing, the data is cut into pieces equal to the stripe size and takes the disk stripes simultaneously: while one data part is still being written, the system starts inputting the next one. In general, RAID0 is the fastest configuration in terms of input/output, but the least fault tolerant one. If any disk of such a system happens to fail, the data of the whole system becomes unreadable.

- RAID 1 applies the mirroring method. During the operation of writing, the system creates an exact copy of the data on another drive. If one disk fails, the other one remains readable. This method has the highest level of reliability and the most expansive disk capacity, though. Disks work in pair only: the system stops working completely without all drives being in operation. RAID 1 is a perfect choice for situations when backing up data is of vital importance.

- RAID 3 is the first RAID level to employ parity. In combination with data striping like in RAID0, this system has a separate dedicated disk that stores parity for other disks. Due to its byte-level writing and a separate disk on which parity is calculated and written, RAID 3 is not able to boast high speed. Such a scheme ensures system security, yet, at the expense of slow operation. For this reason, RAID 3 is not very popular. In case of failure, data is retrieved with the help the intact disks and parity.

- RAID 4 uses the same model as RAID 3 (i.e. striping with dedicated parity) with one difference: while RAID 3 operates at a byte level, this one handles data at a sector level. As a result, this resolves the writing issue to some extent. Nevertheless, RAID 5, a faster and more reliable configuration, has replaced RAID4. Like RAID 3, this level is recovered with the help of the remaining disks plus the disk with parity.

- RAID 5 employs the principles of basic data striping similar to RAID0 and redundancy of RAID 3, but is considered to be a more progressive technology than its predecessors. In RAID 5 parity information is not stored on a separate disk but rather distributed among all data disks according to special rotation schemes. This method has speeded up writing, as the system doesn't have to wait until the parity is calculated on a separate disk. If any of the drives fails, the data will be retrieved from the remaining drives and with the help of parity.

- RAID 6 is a further step on the way to higher reliability. This method implies two layers of parity distributed across all disks according to special order and rotation schemes. Compared to other levels, RAID 6 allows for data recovery in case of two missing drives. This scheme is the most reliable one but the least cost-efficient, as one additional drive is used for storing parity.

6. Appendix

In this section, the most common users' questions are answered. For any further information please contact the developers of the software directly via the contact form.

Does the software modify data on the source drives?

Source drives are opened in the read-only mode, so the software is unable to modify the data. However, this software edition contains tools for explicit data modification. Any incorrect use of the latter may lead to permanent data loss.

What file system is applied on my storage?

If a file system is supported by UFS Explorer, it will be shown in the storages navigation tree as a partition with a certain name. For example, for "NTFS partition", "NTFS" is the file system type.

Does it support an X file system?

This information is available in the software specifications. Anyway, this can be checked by running a trial version of the software.

How can one identify a partition in UFS Explorer?

Find the drive and file system of the corresponding size. Anyway, you may open file system in Explorer and check it looking at the files it contains.

My Windows dynamic disk was not recognized by the software. What is the problem?

The software is likely to have defined a complex dynamic disk (e.g. span, stripe, RAID 5, etc.). UFS Explorer does not assemble RAID automatically. If such RAID is mounted by Windows as a volume, you may open it as a "storage device" by specifying its mount point (NTFS path or drive letter followed by a colon).

Data stored on software/hardware-based RAID is not recognized by the operating system. How can I access the data?

UFS Explorer Professional Recovery supports virtual RAID reconstruction and uses such RAID as a virtual storage to access the data.

The disk image file is split into many fragments. How can one access the data?

The entire disk image can be combined from fragments using the "Disk image of chunk files" main manu option.

There are bad clusters. How can the data be read?

If the data is valuable, it's better to contact a data recovery service laboratory for data recovery. If the data costs less than the fee of a data recovery service, you may use the software to attempt data recovery.

If there are file system errors, it's recommended to use the file system reconstruction tools of UFS Explorer.

My external drive was not recognized, what steps should I take?

A: Check the data cable connection type and if there is enough external power for the drive (e.g. 3.5' drives cannot be powered via USB). To make the software detect the drive, make sure the operating system can recognize the drive as a device.

In Windows: right-click "Computer" choose "Manage". Go to "Storage" and "Disk management". Make sure the disk is listed.

In Linux and macOS there are "Disk utility" in the system applications section that can be used for the same purposes.

Important: if you have connected a disk from other operating system to a computer with Windows OS, it may ask for "disk activation". Decline this prompt to prevent data loss.

The OS recognizes the disk while UFS Explorer does not. What should I do next?

Make sure the software is run using a local Administrator user account (this is required to access physical drives).

If other disks (except the required one) are detected, this may indicate a bad cluster on sector 0 of the drive. In this case, the disk still can be accessed via "Read-It-Once".

7. Keyboard shortcuts

The following keyboard shortcuts work in the Hexadecimal contents tab.