[Paraben Corporation Logo]
Paraben's Data Recovery Stick User Manual
About Paraben's Data Recovery Stick
Welcome to Paraben's Data Recovery Stick!
Paraben's Data Recovery Stick allows you to scan almost any type of storage device (computers, SD cards, USB drives, etc.) and recover deleted data from many popular file formats.
The Data Recovery Stick can recover data from the following types of data storage devices:
- Hard Drives
- USB Drives
- Digital Cameras (must show as a physical drive)
- SD (Secure Digital Card)
- xD-Picture Card
- MiniSD
- microSD
- MultiMediaCard (MMC)
- Reduced Size MultiMediaCard (RS-MMC)
- MMCmobile
- Secure Digital High Capacity (SDHC)
- MMCplus
- miniSDHC
- microSDHC
- MMCmicro
- CompactFlash (CF) Type I and II
- MicroDrive
- MemoryStick (MS)
- Memory Stick Pro
- Memory Stick Duo
- Memory Stick Pro Duo
- MemoryStick Micro (M2)
- MagicGate Memory Stick
- MagicGate Memory Stick Duo
System Requirements
The following requirements must be met to use the Data Recovery Stick:
- x86 or x64 architecture-based computer
- Operating system: Windows XP and higher
Getting Started
Paraben's Data Recovery Stick allows you to perform recovery of deleted data from any FAT 32 or NTFS storage device that shows up as a drive in Windows.
Data Recovery Process
Deleted files are recovered from the investigated storage and placed into the Recovered Data
folder in the following hierarchy: Recovered Data<Recovery date and time><Disk label from which data was recovered><File type>
folder. Recovered files are sorted and placed into the corresponding file type folders.
To perform a data recovery:
- Plug your Data Recovery Stick into your computer and wait for Windows to ask you what you want to do. Select "Open folder to view files". If Windows doesn't ask this, go to My Computer and open the drive labeled "Data Recovery Stick".
- Open the file called
“DataRecoveryStickLauncher.exe”
. - On the main page, in the
Source type
box, select whether the data will be recovered from a logical or physical drive. A hard drive may have multiple "partitions" or logical drives. If you want to recover any data possible on a computer, it is recommended that you select the physical drive. If you know the data you are looking for is stored on a logical drive, you can save time by selecting that logical drive only. - In the
Recover data from
list, select the disk(s) from which data will be recovered. ClickRefresh
to refresh the list of available disks if you attach a new storage device to be recovered. - Choose where to save the recovered files:
- In the
Recover data to
field, select the drive and folder where the recovered data will be placed by either choosing a previous location or clicking theBrowse...
button and navigating to the drive/folder to recover data to.* - By default, the
Browse...
button starts at theRecoveredData
folder on the Data Recovery Stick.
- In the
- Click
Recover Data
. - The data recovery process will begin.
* Please note, it is recommended that you recover data to the Data Recover Stick first. If you choose to save recovered data to the same drive you are recovering from, you risk overwriting deleted files before the stick has a chance to recover them. If you run out of space on your Data Recovery Stick, you may want to attach an external USB drive to recover the remaining data to.
To stop the data recovery, click Stop Recovery
.
Application User Interface
Main Page
You will see this page when you start the Paraben's Data Recovery Stick.
It contains the following elements:
Source type
group of options;- List of available disks on the investigated computer;
Destination folder
for recovered data;Refresh
button;Recover Data
button;- Current recovery details.
From this page, you can do the following:
- Select whether the data recovery will be performed from a logical or physical drive;
- Select the drives from which data will be recovered;
- Define the destination folder for recovered data;
- Start data recovery process.
Screenshot Description: The application's main interface displays options to select between 'Logical drive' and 'Physical drive' for data source. A list of detected drives (C:, D:, E:, F:, Z:) is shown with their available space. Users can specify the destination folder for recovered data using a 'Browse...' button. A 'Refresh' button updates the drive list, and a prominent 'Recover data' button initiates the process. Icons for 'Update', 'Help', and 'About' are also present.
Forensic Mode
Paraben's Data Recovery Stick can be started directly from the USB stick without starting Windows on the computer. This is designed to work under digital forensic requirements for handling evidence. The drive being recovered will have no changes made to it. To begin, insert the USB stick, turn on the computer, and Paraben's Data Recovery Stick will start. This allows you to guarantee data integrity on the computer to be investigated.
Please note that your computer must be set to boot to a FAT 32 USB device in the BIOS.
To start the Data Recovery Stick from the USB stick without starting Windows (Forensic Mode):
- Insert your Data Recovery Stick into a USB port on the computer.
- Start the computer and, during the boot-up screen, enter BIOS (press F2, Del, etc., depending on the specific BIOS of your computer).
- Select the
Boot
tab and then selectHard Disk Drives
. Make sure that the USB stick is set as the 1st Drive. - On the
Boot
tab, selectBoot Device Priority
and check if the USB stick is set as the 1st Boot Device. - On the
Advanced
tab, selectUSB Configuration > USB Mass Storage Device Configuration
. - Set the USB stick as the Device #1 and set the Emulation Type as
Hard Disk
. - Press
F10
to save changes and exit the BIOS. - Paraben's Data Recovery Stick will start without starting Windows OS.
Report Creation
When data recovery is performed, a report is automatically created in the Recovered Data
folder in the following format: Recovered Data<Recovery date and time><Recovery date and time>.txt
.
Screenshot Description: A Windows File Explorer window shows the directory structure for recovered data. The path displayed is << RecoveredData 01-19-11_15-50-55 ►
. Within this folder, a subfolder named 01-19-11_15-50-55
is visible, containing a file named 01-19-11_15-50-56.txt
. The file type is listed as 'Text Document' with a size of 416 bytes and a modification date of '19.01.2011 15:53'.
Recovered File Types
Paraben's Data Recovery Stick detects and recovers the following file types:
Graphics:
- PC bitmap data
- GIF image data
- JPEG image data
- JPEG image data JFIF standard
- JPEG image data, HSI proprietary
- JPEG 2000 image data
- PNG image data
- TIFF image data, big-endian
- TIFF image data, little-endian
- Windows Enhanced Metafile (EMF) image data
- Windows Metafile Format (WMF)
Documents:
- PDF document
- Rich Text Format data
- XML document text
- XML document unicode text
- AutoCAD
- AutoCad (release 12)
- AutoCad (release 13)
- AutoCad (release 14)
- MS Windows HtmlHelp Data
- HTML document text
MS Office:
- Microsoft OLE Compound file
- Windows Installer File
- #.NET Framework configuration file
- #Windows Mobile SDK config file
- Windows XP Thumbnail Database
- Microsoft Automatic Destination file
- $DPV Microsoft Office Publisher wizard
- $XLS Microsoft Office Excel
- $PUB Microsoft Office Publisher
- $MSG Outlook message file
- $DOC Microsoft Office Word
- Test Director templates set
- #Microsoft VisualStudio Solution User Options
- $PPT Microsoft Office PowerPoint 97-2004
- $VSD Microsoft Visio
Databases:
- Microsoft Access Database
- Broken XML document text
Zipped:
- MindManager Brainstorm and Process Control Map
- Microsoft Office 2007 Open XML format
- Microsoft Office 2007 Open XML XLSX
- Microsoft Office 2007 Open XML DOCX
- Open Office OpenDocument Spreadsheet
- Open Office OpenDocument Text
- Open Office OpenDocument Presentation
- Open Office OpenDocument Graphics
- Open Office OpenDocument Database
MP3:
- Audio file with ID3 version 2
Ogg:
- OGG Vorbis Audio
Database:
- SQLite database
- Mozilla Firefox 3 History File Format
- Skype 4 and later database
- ICQ7 database
- Google Chrome History file
Executable files:
- ELF
Archives:
- Zip archive data
- Zip archive data encrypted
- Android Package
Android:
- APK functions file
- Android keychar file
- Android key file
Font:
- TrueType font data
GPSR Compliance Information
Warnings - Choking Hazard for Small Parts.
Manufacturer Contact
Send any compliance requests to:
RaWerks, Inc.
1444 Caramel Cliffs Trail
Mesquite NV 89034
info@rawerks.com