Analysis run

ZAR has been discontinued

After about twenty years, I felt ZAR can no longer be updated to match the modern requirements, and I decided to retire it.

ZAR is replaced by Klennet Recovery, my new general-purpose DIY data recovery software.

If you are looking specifically for recovery of image files (like JPEG, CR2, and NEF), take a look at Klennet Carver, a separate video and photo recovery software.

There are two panels on the program window - left and right. Left panel displays the status information and the volume map; right panel allows you to adjust disk I/O settings as you go. For more information on the disk I/O, refer to runtime control functions.

Volume map is being colored during the scan. The color of the block is assigned depending on the type of data in this block. The colors are as follows:

White - there is nothing in the block, or the block is not yet scanned.
Red - there is at least one bad sector in the block. The red color has a priority over the other colors.
Green - the block contains filesystem structures (MFT entries, directory indexes and so on).
Blue - the block contains file data which ZAR is capable of recognizing.

The analysis typically involves the following steps:

Raw disk scan, when objects of interest like file or filesystem fragments are identified.
Volume parameters detection, mostly computational process deriving several key volume boot sector entries from the data collected during raw scan. Note that even if boot sector is present on the volume, the values will be computed anew anyway. Generally, we do not put much trust into the single data structure on the damaged volume, for doing so will make the process prone to "single point of failure" errors.
Parsing the filesystem, during which the final results are generated: file and directory lists are collected and sorted to reconstruct the folder tree.

Please avoid making estimations about the time of processing based on the information displayed, for the following considerations:

Presence and location of the bad blocks has an immense effect on the raw scan speed, even if the bad block avoidance is configured in bad sector processing options.
Some recovery steps may be computationally and/or memory intensive. ZAR solves quite sophisticated equations to achieve proper recovery. The complexity of these equations depends upon the state of the volume being recovered and the time needed to solve them is thus hardly predictable.

Note that it may take some time to abort the analysis run (either by pressing "Back" button or by exiting the application). Delay of up to five seconds even on a decent machine does not indicate a malfunction. The internal state of the software is quite complex and may take quite a long time to clean it up and relinquish any unneeded resources.