Using QuickScan to detect files and partitions just deleted

QuickScan searches for files, folders and partitions being just deleted. If you are looking for deleted files and folders, you must scan the existing drive (logical disk or volume) to detect files and folders being deleted. If you are looking for deleted partitions and volumes, you must scan unallocated space to detect the drive being deleted.

There are two methods for scanning: QuickScan and SuperScan.

Undelete files: using QuickScan

QuickScan is a fast and basic scan. Partitions and files that have just been deleted most likely will be detected using this method (if no other partition has been created in unallocated space).

Freeware uneraser. SuperScan

SuperScan is a much slower and thorough scan. It processes the whole hard drive surface detecting all possible deleted data. After running QuickScan, if you haven't found proper partition or files, try SuperScan. For more information on SuperScan, click the link at the bottom of this topic.

To run QuickScan:

  1. Open Active@ UNERASER and in the Local System Devices list under the particular Hard Disk Drive or USB Disk, select the Volume (Logical Disk) to be scanned for deleted files, or Unallocated Space to be scanned for deleted partitions
  2. Click QuickScan toolbar button QuickScan button
  3. You can also right-click the Unallocated Space or Volume and select QuickScan from the context menu, or click QuickScan from Action menu
  4. Disk scanning starts. To stop the scanning process for any reason, click Cancel button. After QuickScan is completed, you can inspect detected files and volumes, and recover your data.

QuickScan Plus

QuickScan Plus is an advanced version of QuickScan. It processes more unallocated space where deleted data assumed to be located, so it is a bit slower than QuickScan, however it detects more deleted files and folders. QuickScan Plus is still faster comparing to SuperScan (which processed all available disk space: unallocated and currently allocated).

After the regular QuickScan for the particular volume completed, toolbar button label and related menu items change to QuickScan Plus.

This means that if you scan the same object one more time, some advanced features of QuickScan will be activated. It will take a bit more time, however it could detect more deleted files and folders.

Advanced features include looking for files beyond the "live" system areas (current MFT area on NTFS, or directories tree on FAT).

Moreover, for transactional file systems, like NTFS, Log File ($LogFile) and User Journal ($UsnJrnl$) are processed to get more information about recent transactions (deleting, renaming,...). This could be very useful when you quick-formatted your hard drive or USB flash disk.

To change default action for QuickScan button and menu item to use QuickScan Plus always, open Settings, and on the General tab mark Use QuickScan Plus by default option:

Use QuickScan Plus by default option

Analyzing detected by QuickScan objects

You can tell the state of your files by the color of the icons:

Undelete files: Blue icon shows an existing file

Blue icon shows an existing file

You can tell the state of your folders by the color of the icons:

Undelete files: Yellow icon shows an existing folder

Blue icon shows an existing file

Undelete files: Yellow icon shows an existing folder

Yellow icon shows an existing folder

Undelete files: Grey icon shows a deleted folder

Grey icon shows a deleted folder

You can tell the state of your partitions by the color of the icons:

Undelete files: Grey or Green icon shows an existing partition

Grey or Green icon shows an existing partition

Undelete files: Grey icon with Green box shows a deleted partition has a good integrity status and that can be safely recovered

Grey icon with Green box shows a deleted partition has a good integrity status and that can be safely recovered

Undelete files: Grey icon with Brown or Red box shows a deleted partition that can be recovered

Grey icon with Brown or Red box shows a deleted partition that can be recovered, however this partition might has been formatted before deletion or has some other damage

After you complete the drive scan, to locate your deleted partitions, just look under Unallocated Space nodes. If new partitions appear there - inspect them (click on icon) and verify their content browsing the files and folders.

You can inspect the content of the file by selecting the file and clicking Preview toolbar button, or executing Preview command from the context menu, or by pressing Alt+P key combination.

If you are looking for deleted files and folders, to locate them, you may search either manually, by opening folders in the tree, or automatically, using the search mode.

If you satisfied with results, select an object (file, folder or partition) proceed with a recovery (click Unerase toolbar button).

See Also:

 

sales@lsoft.net

+1 (877) 477-3553,
+1 (905) 812-8434

LSoft Technologies Inc.
2550 Argentia Road, Suite 218
Mississauga, Ontario
L5N 5R1
Canada

© 2016 LSoft Technologies Inc.