4 restoring deleted files – Acronis Disk Director 12 - User Guide User Manual

Page 66

Advertising
background image

66

Copyright © Acronis International GmbH, 2002-2014

2. In Acronis Disk Editor, press the F2 key to switch to the Hex view mode.
3. Place the cursor at the very beginning of the first sector byte (Absolute sector 0, or 0000 in Hex).

Then, press the Shift+Ctrl+End key combination to select the rest of the disk sectors.

4. Click Fill and enter the 0 (zero) fill value.
5. Click OK and then confirm the operation.

Be careful! After you confirm the operation, all the disk data will be deleted completely and you will not be able
to recover it unless you have backups of this disk made with Acronis disk backup and recovery solutions.

7.3.6.4

Restoring deleted files

Acronis Disk Editor can be used to restore deleted files even after the volume has been formatted or
deleted.

A file can be restored only if:

it was stored contiguously as a unit on this volume, i.e. the file should not be fragmented.

it was not overwritten by another data.

Restoring files with Acronis Disk Editor is a bit tricky and requires some hex editor working skills. To
restore a file, you need to obtain some distinctive information about it from the Hex view. This
information will help you to locate the file when searching for it in Hex view.

The following example describes how to restore a couple of .jpeg images files from the formatted
volume.

Prerequisites:

1. The files had been located on the volume My Data (G:) before it was formatted.
2. These images were taken by the certain type of camera.
3. Files were stored as units and they were not overwritten by another data.

To restore files

1. In a file manager that supports Hex, open an existing .jpeg file similar to the deleted file. Our goal

is to find some information that can be used to distinguish these .jpeg files among the other data
stored on the volume.
Lets open a similar .jpeg image that was taken with the same camera in Hex mode with the
Western (Windows) encoding. As we can see in character area, this .jpeg file begins with
something like:

...JFIF....H.H...

and ends with something like:

...OLF...

Normally, when taking a picture the camera writes information about the manufacturer in every
.jpeg file. This information is usually stored at the beginning of every file. Thus, by knowing how
the file begins and ends plus having information about the manufacturer, we have enough
information to distinguish our .jpeg files.

2. In Acronis Disk Director, right-click the formatted volume G: that stored the file you need to

restore, and then click Edit.

3. In Acronis Disk Editor, press the F2 key to switch to the Hex view mode. Then, select the Western

(Windows) encoding on the toolbar.

4. Press the Ctrl+F key combination. Then, enter JFIF in the search field. When this value is found,

take a look at the lines below to see information about the camera manufacturer. If it does not

Advertising