In Windows® 2000/XP (all versions), whenever an entry (file or folder) is deleted the higher order word of the 32-bit starting cluster is erased by the operating system. Hence the correct value of the starting cluster at the time of recovering the entry is not known. Without the exact knowledge of the starting cluster no recovery tool can find out and successfully undelete a deleted entry. To overcome this problem URGENTRECOVERY has devised a solution. Depending on the size of the disk, it generates probable starting cluster values of the file/ folder selected for undelete . In case of a folder the program will automatically try all multiple combinations which may result in a delay during reading process - in case of a file it will ask the user to test each of the multiple combinations.

To decide if the file has been recovered you should open it with the software program applicable to the type of the file recovered - if the application cannot open the file you should let URGENTRECOVERY continue with the next combination until the test succeeds.

If the drive's cluster size exceeds a certain cluster count (depending of the size of the disk), there are too many possible combinations (> 256) and this feature will be limited to this certain cluster count.

It has been seen that the file system driver in the case of NTFS drives tries to optimize the space used by the MFT by resizing it during each time the system is switched on. Once the MFT has been resized (if downsized), it is not possible to recover all the deleted entries.

For best results, it is advisable to run URGENTRECOVERY in the same session the files were deleted.

When a file is sent to the Recycle Bin under Windows NT-based operating system, the file name is no longer preserved. The files will be renamed into 'D drive letter deleted file#'.

When recovering files that have been removed from the recycle bin (folder 'RECYCLER') look for 'D' followed the drive letter of the original file, followed by a number. For example, a file deleted from the E: drive may be named 'DE10.DOC', a deleted file from C: drive may be named 'DC.XLS'. The file extensions will be preserved as well as the deleted date. This rule does not apply to files which have been deleted from The Command Prompt or from within applications, they will retain their file names.

When saving compressed files, guarantee that you are using a Windows® NT-based operating system that supports compression (Windows® 2000/XP). Otherwise the compressed files can not be decompressed and will be saved in a compressed format using the extension '.$compressed'. Files with this extension can be imported later under NT-based operating system uisng the additional URGENTRECOVERY tool 'comimport.exe'.

When saving encrypted files, guarantee that you are using a Windows® NT-based operating system that supports encryption (Windows® 2000/XP) and save the recovered data to a NTFS drive. Otherwise the encrypted file can not be decrypted and will be saved in a packed raw encrypted format using the extension '.$efs'. Files with this extension can be imported later to a NTFS drive using the additional URGENTRECOVERY tool 'efsimport.exe'.

If you have recovered an encrypted file of a user whose account is no longer available or who loses his private key (e.g. due to a system crash) you may use one of the following solutions to read the data again:

Use the Windows® NT Certificates snap-in to import the user's Certificate to read the file. This presupposes that you have exported the user's certificate before.
Recover the file as Recovery Agent (encrypted files are encrypted with the user's key and a Recovery Agent's key, a delegated person whose account is configured as Recovery Agent).
The recovery agent can go to the machine with the encrypted file and load his recovery certificate and private key and perform the recovery on the machine.
NOTE: In a small business or home environment where there are no recovery agents, recovery can be done on a stand-alone computer itself using the local administrator account, which is configured as the default recovery agent.
Back up your encrypted files (using Microsoft Backup) to a .bkf file and send the .bkf file to the Recovery Agent's computer. The Recovery Agent should restore the files on a secured system, decrypt them and send them back to the user.
Refer to your Windows® operating system manual to get more information on decrypting encrypted (encryption recovery) files that have been saved to a NTFS drive.

URGENTRECOVERY is compatible with all Windows® file systems. There may be some problems with the way URGENTRECOVERY accesses the disk and some anti - virus tools may report an error. For best usage, uninstall any anti - virus tools before running URGENTRECOVERY.

Once URGENTRECOVERY has scanned a drive, the user will find a large number of folders named "New Folder" or "New Folder (2)" and so on. These folders are generally created when the user creates a new folder from the Windows® Explorer. The following things happen at the disk level when the user creates a new folder through the Windows® Explorer.

1) A folder named "New Folder" is created in the path chosen by the user.
2) After the user renames it, the "New Folder" gets deleted and the renamed folder name is entered in the disk.

Since URGENTRECOVERY can in no way distinguish whether the "New Folder" is a valid folder or just the initial name of a folder that the user has subsequently renamed, it will show all the "New Folders" as deleted.

* applies only to URGENTRECOVERY Professional Edition