Some things I'd like to see improved in R-Studio, to complete what has been reported already (I'm using version 8.2.165337).
– When exporting a list of the files appearing in the recovery tree, the output should contain at least the files' sizes and modification dates (as Recuva free version does). Some other informations could be useful here, like the first occupied sector, the attributes and whatnot – perhaps it should be selectable in a menu.
– When several directories with the same name, but different dates and contents, are detected in the same parent directory, and are all selected for extraction, the contents are extracted to the same output directory, which retains the timestamps of the last one treated (only if there are subdirectories with the same name does the user get a prompt as to what action should be taken). The default behaviour should be to rename a directory when another has already been extracted with the same name (with “_2”, or with the modification date “ [201711290940]”, or with the first sector of the directory index, whatever), or to prompt the user and ask if the directory should be renamed or should replace the one already extracted – just as it happens in case of files when there's a name collision. (In a case like this, to get as accurate a recovery as possible, I have to unselect all but one of those directories, then after everything is extracted, rename that first one, select the second one and extract it, repeat if there's a third one... If there are many such directory name duplicates in the depths of the directory structure it can be highly painstaking.)
– When a file is renamed because another file with the same name has already been extracted it shouldn't appear as an “error” in the log.
– As already mentioned in this thread, the treatment of junctions is very confusing. I don't have a “technician” version so I can't test if the added options fix those issues or not. When selecting for instance a “Users” directory, it follows the junctions pointing to outer directories which may be unwanted, but the main issue is that unselecting those files/folders inside those outer directories/junctions also unselects them within the main directory (the only painstaking workaround I found is to re-selelect each one of them while taking care
not to re-select the whole main directory, which would bring back to square one).
– Timestamps are not retained for junctions, it appears as if they were created at extraction time. Only when extracting a junction alone does R-Studio extract it as a plain folder (which is actually not a bad thing, if anything it's less confusing) with all the original timestamps.
– When there is a directory with a large quantity of files (thousands), the selection of the whole directory is made almost instantly, but then, unselecting a large number of items (for instance the files in “Extra found files” which are actually hard links for files already in the main directory structure, therefore unnecessary in “Extra found files”), or selecting hundreds of individual files at once, can take a long time and can make R-Studio freeze for a while. (Using a machine with an i7 6700K and 16GB or RAM.)
– There should be a cross-square button (I'm not sure how it's supposed to be called) to close a “File view” tab more quickly than right-click => Close – maybe appearing only when hovering over the corner, like in WinMerge2011 (fork of WinMerge), to avoid adding visual clutter.
– There should be a menu when right-clicking on the buttons in the toolbar to rearrange their layout. (For instance the “Up” button is awkwardly placed, quite far from the directory tree.)
– “FileId” and “ParentId” are confusing, it should be possible to have a column displaying the first sector, maybe also the attributes.
– Creating a volume image as a compressed file is unallowed if the estimated size is superior to the available space on the output partition, despite the fact that the actual size of the image can be much lower if the input volume has a lot of free space, or is highly compressible. There should be an option to go ahead anyway, with a warning, maybe a threshold to stop the creation if the available space gets below X MB.
– Compared with GetDataBack 4.33 (legacy version, replaced by GetDataBack Simple which doesn't seem to be much of an improvement with regards to recovery efficiency), R-Studio very rarely detects former versions of modified files when they exist. (But GDB, if allowed to extract several files with the same name, sometimes extracts a crazy number of exact duplicates, or overwritten files which turn out to be garbage, adding a staggering amount of clutter to sort out later in post-processing...)
– It should be possible to make a quick search based on the MFT, akin to what Recuva does by default. As it is, it's not practical to recover a single file which has just been deleted. (Even R-Undelete, last time I checked, despite being a more basic software supposedly aimed at more simple recovery tasks, doesn't have that option and insists on scanning the whole volume.) Running a partial scan (first 10GB for instance) can be enough to display the currently allocated and deleted files, but only if the whole MFT is located within the scanned area, yet sometimes MFT records can be found at the very end of a large partition, meaning one has to scan it completely just to recover a file deleted a minute ago – and in the meantime it could have been overwritten by system files, or by the trimming process on SSDs. Recuva works better to solve that kind of SNAFUs.
– The naming scheme for “Extra found files” should include the first sector number, as Photorec does, instead of using an arbitrary number based on the order in which all those extra carved files were detected, depending on the chosen options. As it is currently, if making two subsequent searches on the same volume with different options in “Known file fypes”, the very same file can be given a different name, and will therefore be extracted twice (unless the user tries to painstakingly identify the exact duplicates by their size and first sector as displayed in the Hex viewer, if two instances of R-Studio are open simultaneously).
– The detection of MKV files as “Extra found files” used to be lackluster, but seems to have greatly improved lately (I haven't made thorough tests yet). I reported
this issue on the R-TT forum about a year ago.
– It should be possible to selectively extract files based on their type / extension within the main directory structure.
– The timestamps of directories in “Extra found files” are absurd, showing modification dates in 2013 / 2010 / 2014 / 2008, whatever... not a big deal but confusing nonetheless. For those directories only the extraction date is relevant.
– There should be two distinct directories for “Extra found files” and “Extra found folders”, since their origin and status are distinct. Most files found by signature search are valid files, while files found inside extra folders can either be completely valid, if it's a recently deleted folder, or can be overwritten files which happen to still have MFT records. Also, when there are many orphaned folders it would be convenient to collapse them while exploring the neatly organized “Extra found files”, which can currently appear at the bottom of a frighteningly long list of folders containing mostly garbage.
– Recuva displays the files' status, indicating if they are in excellent state when no clusters have been overwritten, or good / poor / unrecoverable when some or many clusters have been overwritten by another file, and which file that is (I guess it's the file which has overwritten the begining of the older file when a file has been overwritten by several files).
It's not perfectly reliable, but still very useful, and yet R-Studio doesn't have a similar feature as far as I know.
– In the Hex viewer, it is not possible to export the list of clusters occupied by a file, only one value at a time can be copied with CTRL+C. Recuva and HD Sentinel do allow to export a complete list of sectors / clusters (I've used that to solve a recent
SNAFU of mine).
– When using the “Show files in HexEditor” feature, there's an inconsistency (I reported it
here) : to display a sector's contents one has to type its
logical number in the whole volume's hexadecimal presentation, but to get the name of the file it belongs to one has to type its
absolute number, thus adding the partition offset. For instance, if I want to know what file does sector 5677400 belong to, on a partition begining at 129MB, or sector 264192, I have to type 5677400 + 264192 = 5941592, but the sector's contents appear at sector number 5677400 (easy to spot if it's the file's header). (Perhaps this could be related to my confusion with the notion of “parent ID” ?...)
– There should be a way to display what file (or files when several records are identified for a given sector) a sector belongs to
without attempting to read its contents, that would be very useful when trying to isolate files occupying bad sectors identified by a surface scan. See the linked SuperUser thread above, and
this one I initiated – the best tool I found for that purpose is Defraggler, yet a full-blown data recovery software like R-Studio should be able to provide that kind of informations. By the way, a volume map, similar to that of a defragmentation tool, would be a great addition.
@TerraNova :
Quote:
Why can't R-Studio skip bad sectors automatically and continue the next files when recovering files manually? so frustrating i have to skip the file manually
Anyway it's not recommanded to use a files & folders recovery software like R-Studio on a device with bad sectors. First perform a complete clone or volume image, then run R-Studio and any other software on the clone or image.