DR Advanced Recovery Workbench

DR Advanced Recovery Workbench reads a disk, or an image of one, directly and read-only, finds the file systems on it, and rebuilds each one from its own metadata. The result is one catalog of the files that are still there, the files that were deleted, and whole folder trees nothing points at any more, with a verdict for every deleted file on whether its data has since been overwritten. It covers APFS, HFS+, NTFS, FAT12/16/32, exFAT, ext2/3/4, XFS, and Btrfs in one program, available for Windows, Mac, and Linux.

What it does

• Reads raw disks and disk images directly. Nothing is mounted, nothing is repaired in place, and nothing is written to the source. It works on a disk the operating system cannot read, a drive that was formatted, or an image taken from a failing drive.
• Probes the device and lists every file system it finds, largest first, so you can pick the volume you want, including volumes whose partition table is gone.
• Rebuilds the chosen file system from its metadata into one catalog: existing files, deleted files, and orphaned folder trees, with status, overwrite risk, type, size, and full path for every entry.
• Gives every deleted file an overwrite-risk verdict from the live allocation map, so you know before you copy whether its blocks have been handed to something else.
• Recovers everything, only the deleted files, or a hand-picked selection, to a folder you choose. Compressed files are expanded on the way out, including NTFS compression and Apple decmpfs.
• Shows progress and read and write throughput live while it works. Scans and recoveries can be stopped at any time, and the partial results are kept.
• Reads in parallel, with a read pattern you can set for a hard drive or an SSD.

Two kinds of scan

Quick scan walks the file system’s own metadata: the catalog, the file table, the inode tables, the trees. It is fast, and it is the right first move when the volume is mostly intact and you want deleted files back.

Sector scrub does everything quick scan does and then sweeps the whole device for structures nothing points at any more: file records outside the live table, orphaned directory clusters, stale copy-on-write leaves, old catalog nodes left in a journal. When no volume can be detected at all, it first searches the device for lost volumes, and on APFS it falls back to checking every block for valid objects.

Where the deleted files come from

Each file system loses files in its own way, so the Workbench has a reader written for each one.

• NTFS. Walks the Master File Table, including records whose in-use flag is clear but still carry a valid name. Those are the deleted files. Compressed files, alternate data streams, and attribute lists are handled, and the $Bitmap decides overwrite risk. Scrub sweeps the disk for file records that are no longer inside the live table.
• FAT12/16/32. Finds deleted entries and reassembles their long file names (the first character of the short name is lost on delete and shown as an underscore), walks deleted directories while their clusters still look like directories, and reads the FAT for risk. Scrub finds orphaned directory clusters.
• exFAT. Finds entry sets with the in-use bit cleared, plus stream entries whose file entry was already overwritten, honours the NoFatChain flag, and reads the allocation bitmap for risk.
• ext2/3/4. Reads the full inode tables, scans the gaps in directory blocks for removed names, and replays the journal for older copies of inodes and directory blocks. ext3 and ext4 zero a file’s block pointers on delete, so the journal is where the data is found. ext2 has no journal, so there it recovers names only.
• XFS. Reads the inode B+trees and all three directory formats, unpacks the log to recover logged inodes and directory buffers, and uses generation numbers to tell a deleted file from a live one that reused its inode number.
• Btrfs. Builds the chunk map, walks every file system tree including subvolumes and snapshots, reads the extent tree for risk, and falls back to the backup roots. Scrub finds stale copy-on-write leaves anywhere on the device by checksum.
• HFS+. Reads deleted records from the slack space of catalog leaf nodes and from nodes that fell out of the leaf chain. Scrub reads any catalog-looking node anywhere on the disk, including the journal. Files compressed with decmpfs are expanded.
• APFS. Quick scan reads the checkpoint ring, the snapshots, and the object-map history for earlier states of the volume. Scrub reads every valid object on the device. Fusion containers with a second tier are detected.

What you need

• A 64-bit Windows, Mac, or Linux computer. Reading a physical disk directly needs an administrator or root session; disk images open without one.
• The disk, or an image of it. Imaging a failing disk first is what our own lab does, and the Workbench reads the image exactly as it would read the disk.
• A second drive with enough free space for the recovered files. Recovered data goes only to the folder you choose, never back to the source.
• A volume on a single device, Apple Fusion containers included. Striped Btrfs and XFS sets across several disks are not covered.

How it will work

1. Run the program and choose a disk or open an image.
2. Probe the device. Every file system found is listed, largest first; pick the one you want.
3. Choose Quick scan or Sector scrub and let it run. Progress and throughput are shown live, and you can stop at any time and keep what has been found.
4. Review the catalog: existing, deleted, and orphaned files, each deleted file with its overwrite-risk verdict.
5. Recover everything, only the deleted files, or the files you tick, to a folder you choose.

Your disks are never modified

The Workbench opens every disk and image read-only, and that rule is in the engine, not in a setting. It never mounts the volume, never runs a repair, and never writes to the source. Recovered files go only to the output folder you choose. If the disk itself is failing, stop and image it first, or send it to us.

Built like the rest of our software

The Workbench is a new program from our engineering team, built for recovery work, and it follows the same rules as every program we sell: one signed file per platform, no installer, no background service, no license server, and it works entirely on local disks and files. The same license works on Windows, Mac, and Linux.

Want to know the day it ships? Email help@datarecovery.com with Workbench in the subject line and we will let you know. If you have a case that cannot wait, call 800.237.4200 or start a recovery ticket.