interface

 

Chapter 6 – User Interface

 

W tym rozdziale

Chapter 6 – Recover My Files v5 User Interface

6.1         Introducing the Recover My Files v5 Interface

6.2         Toolbar (Top)

6.3         Tree pane (Left)

6.3.1       Folders view

6.3.2       File Type view

6.3.3       Deleted view

6.3.4       Date view

6.4         List Pane (top right)

6.4.1       File View

Sort

Text Filter

6.4.2       Gallery View

6.5         Display Window (bottom)

6.5.1       Display

6.5.2       Hex view

6.5.3       Text View

 

 


6.1      Introducing the Recover My Files v5 Interface

The Recover My Files Graphic User Interface (GUI) is broken down into the following areas:

1.       Toolbar (top)

2.       Tree pane (left)

3.       List pane (right)

4.       Display pane (bottom)

5.       Status bar (bottom)

As shown in Figure 24 below:

Figure 24, Recover My Files main screen

Description: C:\Users\GRAHAM~1.GRA\AppData\Local\Temp\SNAGHTML45cff6a.PNG

The Recover My Files v5 GUI is however highly configurable. The Tree, List and Display panes hold different “data views” used to present search results to the user. Each of the data views can be moved and re-attached to the other pane, or completely detached from the main program screen. Customized screen layouts can be saved and loaded as required. Refer to Chapter 15 for further information on customizing the interface.

 


 

6.2      Toolbar (top)

At the top of the program tool bar is the Recover My Files drop down menu, shown in Figure 25 below:

Figure 25, Recover My Files drop down menu

Description: C:\Users\GRAHAM~1.GRA\AppData\Local\Temp\SNAGHTML82f068.PNG

The drop down menu contains the following unique functions:

Export CSV file:    Exports the listing of current search results to as CSV file.

Print Report:       Prints a listing of the current search results to an installed printer. A confirmation message is displayed showing the number of pages that will be printed.

Disk Imager:         Runs the disk imaging program used to acquire sector copies of drives. See Chapter 14 – Drive Imaging.

Exit:                       Closes Recover My Files. A confirmation prompt is provided if search results are currently listed.

The other functions in the drop down menu are replicated in the toolbar icons, described as follows

Opens the start search wizard.

Opens the save dialogue to save search results. See Chapter 10 – Saving Files.

Runs the File Type Validation Tool

 

Opens the program options window. See Chapter 12 – Options.

Used to save and load a listing of search results. See Chapter 10 – Saving Files.

Used to stop the progress of a search.

Checks for program updates. An internet connection is required.

Opens the program “about” window, which contains version, activation and support information.

Opens this support documentation.

Links to the program purchase page at
http://www.creamsoft.com/sklep/getdata.html

Opens the program activation window. Also used to upgrade between licenses, e.g. Standard to Professional.

The toolbar is also used the place where search progress is reported to the user. Messages relating to the current search are displayed with the progress bar.

6.3      Tree pane (left)

The Tree pane is the top left hand window of the search results screen.

Figure 26, Tree pane

Description: C:\Users\GRAHAM~1.GRA\AppData\Local\Temp\SNAGHTML50f612.PNG

The tree pane is the default location for the data views Folders, File Type, Deleted and Date.

Navigation

To navigate the Tree pane data views:

·         Use the keyboard arrow keys to traverse, expand and contract a tree;

·         Double click a folder to drill down into its sub folders;

·         Click the   and   symbols to expand and contract the tree hierarchy;

·         Right click and use “Expand” to expand the currently selected folder, or “Expand All” to expand all folders; use “Contract” to contract the currently selected folder, or “Contract All” to contract all folders.

Clicking on a folder in the Tree pane data views lists the contents of the folder in the adjacent List pane (described in 6.4 below).

Tree Pane Icons

The following icons are used in the Tree pane data views:

A device, e.g. a hard drive or camera card

Active (booting) partition

Description: partition.jpg

Partition

An expandable branch (folder structure)

An active folder

A deleted folder

Selection Box

 

 
Folders listed in the Tree pane data views are preceded by a selection box. The selection box is ticked to indicate that a file or folder is to be saved (Learn more about saving files in Chapter 10). A tick in a selection box for a file or folder will also show in any other data view in which that file is displayed.

Branch Plate Description: New

A powerful feature of the Tree pane data views is the “branch plate. The branch plate allows the entire contents of a folder and its subdirectories to be displayed in a list in the adjacent list view. (Learn more about branch plating in Chapter 12.1.1).

6.3.1      Folders view

Folders view displays all the folders on the examined drive:

Figure 27, Tree pane, Folders view

Elements in Folders view include:

  Lost Files

The Lost Files folder contains the results of File carving (See Data Recovery Fundamentals at the start of this manual for more information). The Lost Files folder is created in both a Recover Files (for “deleted and lost files”) and a Recover Drive search.

Description: partition.jpg Partition @ [Sector Number] (Recover Drive search only)

A partition appears in a Recover Drives search only. This is a partition which exists on the hard drive and is not missing or deleted. Folders and files in this partition (which are not deleted, lost or orphaned), should be accessible with Windows Explorer.

  Orphaned

Orphans are deleted folders and files for which the original parent folder is unknown.

  Root

The Root folder (also referred as root directory) is the first level folder of a folder hierarchy. A root folder will exist in both an existing and a recovered partition.

  Recovered [File-system] Partition @ [Sector Number] (Recover Drive search only)

A recovered partition folder is created in a Recover Drive search only. Its name describes the type of File-system that has been found, and the sector number where it is located. This is where missing file and folder structure will be found in a drive recovery.

6.3.2      File Type view

The File Type view sorts files by extension. This view shows all files on the examined drive.

Figure 28, Tree pane, File Type view

6.3.3      Deleted view

This view shows those files marked by the file-system as deleted and the lost files carved from the free space.

Figure 29, Tree pane, Deleted view

6.3.4      Date view

The date view sorts files by date, grouping by year, month and day. This view shows all files on the examined drive.

Figure 30, Tree pane, Date view

 


 

6.4      List Pane (top right)

The top right window of the Recover My Files v5 screen is the “List” pane. The List pane is the default location for data views: File View; Gallery View; and Drive View.

Figure 31, List pane

Description: C:\Users\GRAHAM~1.GRA\AppData\Local\Temp\SNAGHTML8cbf5b.PNG

To navigate in the List pane:

                     Use the keyboard arrow keys to move up and down the list;

                     Double click a folder to drill down into its sub folders; or

Files in the List window (excluding Drive view) are preceded by a selection box . The selection box is ticked to indicate that a file or folder is to be saved. A tick in a selection box for a file or folder will also show in any other data view in which that file is displayed. Learn more about saving files in Chapter 11.

6.4.1      File View

File view lists the file name and metadata (extension; size; path; modified, created; etc.) of the currently highlighted folder/s in the Tree pane. The Tree pane view name is appended in brackets (e.g. “File View (Folders)” in Figure 32 below) to identify the source of the list.

File view is also the window in which a sort or filter is applied (described further below).

Figure 32, List pane, File view

 The following icons are used in File view:

Free space on drive (Space on the physical drive which is not in use)

Free space in partition (Space inside a partition which is not in use)

Unallocated clusters on FAT volume

Unallocated clusters on NTFS volume

An active file

An active folder

A deleted file

A deleted folder

A system file

A lost file

 

 

The following metadata columns are used in File view:

File Name:                The name of the artifact (system file, partition etc.) or the name of the file.

Extension:                The suffix to the file name, for example .jpg, which indicates the file format. This column reports the given file extension only and does not validate it as correct.

Is Deleted                 The state of the file. A deleted file shows a state of “Yes” in this column.

Full Path:                  Displays the full location of the file.

Logical Size:             The size of the file in bytes.

Modified:                 The date and time that a file was opened, edited, and saved.

Created:                   The date and time a file was created in its current storage location (not necessarily the original creation date of the file itself).

Sort

To sort by a single column, double click on the column heading, e.g. “Filename”. An arrow will appear showing the direction of the sort. Double click again on the column heading to reverse the sort:

Figure 33, Single column sort

The same single column sort result can be achieved by right clicking on the column, selecting the “Sort” menu item and selecting to “Sort Ascending” or “Sort Descending”:

Figure 34, Multi column sort menu

To sort by multiple columns using the CTRL key:

1.       Double click on the first column heading, e.g. “Filename”. An arrow will appear showing the direction of the sort. Double click again on the column heading to reverse the sort;

2.       Hold down the SHIFT key on the keyboard;

3.       Double click on the second column heading, e.g. “Filename”. A double arrow will appear to indicate that it is the second column in the sort.

4.       Continue to add columns to the sort by following steps 1 to 3 above.

Figure 35, Sort by FileName, then Full Path, then Logical Size

The same results can be achieved with the right click menu:

1.       Right click in the List view and select: Sorting > Sort Multi Column. The “Sort Column Selection” window is displayed:

Figure 36, Multi column selection window

Visible columns are shown in the left hand window:

2.        Select the required sort columns;

3.       Add the required sort columns to the right hand window;

4.       Use the “Move Up” and “Move Down” buttons to set the order on which to sort the columns;

5.       Click the “Sort” button to apply the sort.

To remove a multiple column sort:

Release the SHIFT key and double click on a column heading to return to a single column sort.

Text Filter

The text filter tool is applied in List view and allows instant text filtering on column data. It is situated above the List view column headings. When the filter is applied, the outline of the filter box/s turns red in color, as shown in Figure 37 below;

Figure 37, Text filter tool

Description: C:\Users\GRAHAM~1.GRA\AppData\Local\Temp\SNAGHTML17f5ae3.PNG

The text filer tool is visible by default. To show or hide the tool:

1.       Right click on the File view window;

2.       From the drop down menu, select “Text Filter Tool”:

To apply a text filter:

1.       Type into the filter field above the column heading:

                                 i.             Requires A-Z characters;

                                ii.             Requires numbers 1 – 9;

                              iii.             Requires a date format.

2.       As text is typed into the filed the displayed content updates based upon the typed criteria.

To apply multiple column text filters:

1.       Enter the filter criteria into the field above each column heading. Multiple text filters are joined with the “and” operator.

To remove a column filter/s:

1.       Remove the text from each text filter field used; or

2.       Close the text filter by clicking the  icon in the checkbox column heading.

6.4.2      Gallery View

Gallery view is used to thumbnail graphics files (jpg, bmp and png) in the currently highlighted folder/s.

Figure 38, Gallery view thumbnails

Graphics displayed in Gallery view are determined by the selection made in the Tree pane (left window).

If a single folder is selected, the graphics inside that folder will be displayed. The branch plate option (see 12.1) can be used to display all graphics on the drive at one time.

The default setting in Gallery view is to render and display thumbnails 1 page ahead. For each page displayed, the following page is also rendered and is available to the user after a page down command or use of the scroll bar.

In some situations it may be advantageous to render all available images.

To cache thumbnails to RAM;

  1. Select or branch plate the required folders in the Tree pane data view to display the gallery view thumbnails;

  2. Right click in the gallery view window and select “Cache All Images

Thumbnails will be cached to RAM. A rotating drive will appear in the bottom right hand corner of the gallery view window to indicate that caching is in progress.

The size and number of graphics displayed is controlled by moving the slide-bar in the footer of this window from small to large.

Figure 39, Gallery view scale bar

The Gallery view tab can also be detached from the File List view pane and re-sized displayed as a standalone window (see the chapter on “Customizing the Interface” for more information).


 

6.5      Display Window (bottom)

The display window enables the user to view the content of the currently highlighted file. This is done using three different data views: Display; Hex; and Text.

6.5.1      Display

The File Display view uses GetData’s Explorer View technology to display the content of hundreds of different file types:

Figure 40, Display view

Description: C:\Users\Graham\AppData\Local\Temp\SNAGHTMLe6d84d4.PNG

Note that the file Display tab is a preview only. It is NOT intended as an exact render of how the file would have appeared to the end user when opened with its creating application.

If a file type is selected where a display is not available, or the file is corrupt, an error message will display in this window. The display view will default to Hex or Text view.

Depending on the type of file being displayed, the following icons become available in the File Display tab:

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_zoomout.gif         Zoom out

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_zoomin.gif         Zoom in

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_rtr.gif         Rotate Right degrees

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_rtl.gif         Rotate left 90 degrees

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_print.gif         Print

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\ev_icon_binos.gif         Search (text or hex modes)

        Full 1:1 picture size and ratio

        Fit picture to screen size

        Detach picture and display full screen

Description: C:\Users\Graham\GETDATA\Help Files\EV\EV - English\image37.jpg       Audio buttons

The following options are also available by right clicking the preview window:

Figure 41, Display view right click options

6.5.2      Hex view

Description: Description: alert, attention, compile, exclamation icon The hex view tab is a Professional & Technician license feature only. It will not appear when Recover My Files is activated with a Standard license key. (See 4.2.4 for a comparison of license features).

The Hex tab shows a hexadecimal/ASCII view of the currently highlighted file.

Figure 42, Hex view

Description: C:\Users\Graham\AppData\Local\Temp\SNAGHTMLe0cabe1.PNG

6.5.3      Text View

The Text tab shows the selected file as ASCII text.

Figure 43, Text view

Description: C:\Users\Graham\AppData\Local\Temp\SNAGHTMLe91304f.PNG