winternals erd commander 2003 用户手册
ERD Commander 2003
User’s Guide
3.11 Using FileRestore
Use ERD Commander’s FileRestore utility to recover deleted files from the
system you are repairing. Its interface, like that of ERD Commander 2003 File
Search, is similar to that of the Windows 2000 File Search utility. The search
pattern you enter can contain any subset of the file or path names for which
you wish to search, and can include the asterisk (*) wild-card character.
Optionally, you can modify your search to only include results with
modifications within a certain time period, or of a particular size. When you
Click the Search button FileRestore searches the locations you specified and
displays found items in the right pane of its window.
FileRestore attempts to determine whether each deleted file is recoverable
and reports the result in the Recoverability column. If a file is marked Likely it
means that none of the file's data is known to be overwritten by other files.
However, this is only an estimate of the file’s condition, and it is possible that
even a file marked Likely will contain corrupt data. In general the longer the
time since a file has been deleted the less likely that it can be recovered.
When searching for files on FAT or FAT32 volumes the first letter of the file
name cannot always be retrieved. For this reason FileRestore displays files
that match all characters entered in Search for files named, as well as those
matching all characters but the first. Whenever the first letter cannot be
retrieved it is replaced by the question mark character (‘?’) when displayed
and by an underscore (‘_’) when the file is copied to a new location.
If a file is found but it cannot be determined which directory it belongs to
(usually because the parent directory is also deleted) then it is placed in a
directory labeled “...Unknown Folder #...”. It is possible for there to be multiple
orphan directories, each corresponding to a different directory that no longer
exists.
Winternals Software
Page 33