Chapter 6 - Recover My Files v5 User Interface

6.1 User Interface

The Recover My Files Graphic User Interface (GUI) is broken down into the following areas:

1. Toolbar (top)
2. Tree pane (left)
3. List pane (right)
4. Display pane (bottom)
5. Status bar (bottom)

As shown below:

The Recover My Files v5 GUI is however highly configurable. The Tree, List and Display panes hold different “data views” used to present search results to the user. Each of the data views can be moved and re-attached to the other pane, or completely detached from the main program screen. Customized screen layouts can be saved and loaded as required. Refer to Chapter 15 for further information on customizing the interface.

6.2 Toolbar (top)

At the top of the program tool bar is the Recover My Files drop down menu, shown below:

The drop down menu contains the following unique functions:

• Export CSV file: Exports the listing of current search results to as CSV file.
• Print Report: Prints a listing of the current search results to an installed printer. A confirmation message is displayed showing the number of pages that will be printed.
• Disk Imager: Runs the disk imaging program used to acquire sector copies of drives. See Chapter 14 – Drive Imaging.
• Exit: Closes Recover My Files. A confirmation prompt is provided if search results are currently listed.
• The other functions in the drop down menu are replicated in the toolbar icons, described as follows:

Opens the start search wizard.

Opens the save dialogue to save search results. See Chapter 10 – Saving Files.

Runs the File Type Validation Tool

Opens the program options window. See Chapter 12 – Options.

Used to save and load a listing of search results. See Chapter 10 – Saving Files.

Used to stop the progress of a search.

Checks for program updates. An internet connection is required.

Opens the program “about” window, which contains version, activation and support information.

Opens this support documentation.

Links to the program purchase page at www.recovermyfiles.com

Opens the program activation window. Also used to upgrade between licenses, e.g. Standard to Professional.

The toolbar is also used the place where search progress is reported to the user. Messages relating to the current search are displayed with the progress bar.

6.3 Tree pane (left)

The Tree pane is the top left hand window of the search results screen.

The tree pane is the default location for the data views Folders, File Type, Deleted and Date.

Navigation

To navigate the Tree pane data views:

• Use the keyboard arrow keys to traverse, expand and contract a tree;
• Double click a folder to drill down into its sub folders;
• Click the and symbols to expand and contract the tree hierarchy;
• Right click and use “Expand” to expand the currently selected folder, or “Expand All” to expand all folders; use “Contract” to contract the currently selected folder, or “Contract All” to contract all folders.

Clicking on a folder in the Tree pane data views lists the contents of the folder in the adjacent List pane (described in 6.4 below).

Tree Pane Icons

The following icons are used in the Tree pane data views:

A device, e.g. a hard drive or camera card

Active (booting) partition

Partition

An expandable branch (folder structure)

An active folder

A deleted folder

Selection Box

Folders listed in the Tree pane data views are preceded by a selection box. The selection box is ticked to indicate that a file or folder is to be saved (Learn more about saving files in Chapter 10). A tick in a selection box for a file or folder will also show in any other data view in which that file is displayed.

Branch Plate

A powerful feature of the Tree pane data views is the “branch plate”. The branch plate allows the entire contents of a folder and its sub directories to be displayed in a list in the adjacent list view. (Learn more about branch plating in Chapter 12.1.1).

6.3.1 Folders view

Folders view displays all the folders on the examined drive:

Elements in Folders view include:

• Lost Files: The Lost Files folder contains the results of File carving (See Data Recovery Fundamentals at the start of this manual for more information). The Lost Files folder is created in both a Recover Files (for “deleted and lost files”) and a Recover Drive search.
• Partition @ [Sector Number] (Recover Drive search only):A partition appears in a Recover Drives search only. This is a partition which exists on the hard drive and is not missing or deleted. Folders and files in this partition (which are not deleted, lost or orphaned), should be accessible with Windows Explorer.
• Orphaned: Orphans are deleted folders and files for which the original parent folder is unknown.
• Root: The Root folder (also referred as root directory) is the first level folder of a folder hierarchy. A root folder will exist in both an existing and a recovered partition.
• Recovered [File-system] Partition @ [Sector Number] (Recover Drive search only): A recovered partition folder is created in a Recover Drive search only. Its name describes the type of File-system that has been found, and the sector number where it is located. This is where missing file and folder structure will be found in a drive recovery.

6.3.2 File Type view

The File Type view sorts files by extension. This view shows all files on the examined drive.

6.3.3 Deleted view

This view shows those files marked by the file-system as deleted and the lost files carved from the free space.

6.3.4 Date view

The date view sorts files by date, grouping by year, month and day. This view shows all files on the examined drive.

6.4 List Pane (top right)

The top right window of the Recover My Files v5 screen is the “List” pane. The List pane is the default location for data views: File View; Gallery View; and Drive View.

To navigate in the List pane:

• Use the keyboard arrow keys to move up and down the list;
• Double click a folder to drill down into its sub folders; or

Files in the List window (excluding Drive view) are preceded by a selection box . The selection box is ticked to indicate that a file or folder is to be saved. A tick in a selection box for a file or folder will also show in any other data view in which that file is displayed. Learn more about saving files in Chapter 11.

6.4.1 File View

File view lists the file name and metadata (extension; size; path; modified, created; etc.) of the currently highlighted folder/s in the Tree pane. The Tree pane view name is appended in brackets (e.g. “File View (Folders)” in Figure 32 below) to identify the source of the list. File view is also the window in which a sort or filter is applied (described further below).

The following icons are used in File view:

Free space on drive (Space on the physical drive which is not in use)

Free space in partition (Space inside a partition which is not in use)

Unallocated clusters on FAT volume

Unallocated clusters on NTFS volume

An active file

An active folder

A deleted file

A deleted folder

A system file

A lost file

The following metadata columns are used in File view:

• File Name: The name of the artifact (system file, partition etc.) or the name of the file.
• Extension: The suffix to the file name, for example .jpg, which indicates the file format. This column reports the given file extension only and does not validate it as correct.
• Is Deleted: The state of the file. A deleted file shows a state of “Yes” in this column.
• Full Path: Displays the full location of the file.
• Logical Size: The size of the file in bytes.
• Modified: The date and time that a file was opened, edited, and saved.
• Created: The date and time a file was created in its current storage location (not necessarily the original creation date of the file itself).

Sort

To sort by a single column, double click on the column heading, e.g. “Filename”. An arrow will appear showing the direction of the sort. Double click again on the column heading to reverse the sort:

The same single column sort result can be achieved by right clicking on the column, selecting the “Sort” menu item and selecting to “Sort Ascending” or “Sort Descending”:

To sort by multiple columns using the CTRL key:

1. Double click on the first column heading, e.g. “Filename”. An arrow will appear showing the direction of the sort. Double click again on the column heading to reverse the sort;
2. Hold down the SHIFT key on the keyboard;
3. Double click on the second column heading, e.g. “Filename”. A double arrow will appear to indicate that it is the second column in the sort.
4. Continue to add columns to the sort by following steps 1 to 3 above.

The same results can be achieved with the right click menu:

1. Right click in the List view and select: Sorting > Sort Multi Column. The “Sort Column Selection” window is displayed:
   
   
   Visible columns are shown in the left hand window:
2. Select the required sort columns;
3. Add the required sort columns to the right hand window;
4. Use the “Move Up” and “Move Down” buttons to set the order on which to sort the columns;
5. Click the “Sort” button to apply the sort.

To remove a multiple column sort:

Release the SHIFT key and double click on a column heading to return to a single column sort.

Text Filter

The text filter tool is applied in List view and allows instant text filtering on column data. It is situated above the List view column headings. When the filter is applied, the outline of the filter box/s turns red in color, as shown below;

The text filer tool is visible by default. To show or hide the tool:

1. Right click on the File view window;
2. From the drop down menu, select “Text Filter Tool”:

To apply a text filter:

Type into the filter field above the column heading:

Requires A-Z characters;

Requires numbers 1 – 9;

Requires a date format.

As text is typed into the filed the displayed content updates based upon the typed criteria. To apply multiple column text filters:

• Enter the filter criteria into the field above each column heading. Multiple text filters are joined with the “and” operator.

To remove a column filter/s:

1. Remove the text from each text filter field used; or
2. Close the text filter by clicking the icon in the check box column heading.

6.4.2 Gallery View

Gallery view is used to thumbnail graphics files (jpg, bmp and png) in the currently highlighted folder/s.

Graphics displayed in Gallery view are determined by the selection made in the Tree pane (left window). If a single folder is selected, the graphics inside that folder will be displayed. The branch plate option (see 12.1) can be used to display all graphics on the drive at one time.

The default setting in Gallery view is to render and display thumbnails 1 page ahead. For each page displayed, the following page is also rendered and is available to the user after a page down command or use of the scroll bar.

In some situations it may be advantageous to render all available images.

To cache thumbnails to RAM;

1. Select or branch plate the required folders in the Tree pane data view to display the gallery view thumbnails;
2. Right click in the gallery view window and select “Cache All Images”

Thumbnails will be cached to RAM. A rotating drive will appear in the bottom right hand corner of the gallery view window to indicate that caching is in progress.

The size and number of graphics displayed is controlled by moving the slide-bar in the footer of this window from small to large.

The Gallery view tab can also be detached from the File List view pane and re-sized displayed as a standalone window (see the chapter on “Customizing the Interface” for more information).

6.5 Display Window (bottom)

The display window enables the user to view the content of the currently highlighted file. This is done using three different data views: Display; Hex; and Text.

6.5.1 Display

The File Display view uses GetData’s Explorer View technology to display the content of hundreds of different file types:

Note that the file Display tab is a preview only. It is NOT intended as an exact render of how the file would have appeared to the end user when opened with its creating application.

If a file type is selected where a display is not available, or the file is corrupt, an error message will display in this window. The display view will default to Hex or Text view.

Depending on the type of file being displayed, the following icons become available in the File Display tab:

Zoom out

Zoom in

Rotate Right degrees

Rotate left 90 degrees

Print

Search (text or hex modes)

Full 1:1 picture size and ratio

Fit picture to screen size

Detach picture and display full screen

Audio buttons

The following options are also available by right clicking the preview window:

6.5.2 Hex view

The hex view tab is a Professional & Technician license feature only. It will not appear when Recover My Files is activated with a Standard license key. (See 4.2.4 for a comparison of license features).

The Hex tab shows a hexadecimal/ASCII view of the currently highlighted file.

6.5.3 Text View

The Text tab shows the selected file as ASCII text.

© GetData 2002-2024 All Rights Reserved. Recover My Files Home | Resellers | About Us | Sitemap | Privacy | User Agreement | Returns