Additional settings

Klennet Carver has some settings I do not recommend that you ever use. Legitimate use cases for these settings are very few. If you find youself requiring one of those, consider rethinking your recovery plan.

Specifying area on the media to scan

If you want Carver to limit its scan to a certain area of the media, do this:

  1. Right-click the original media in the list, hard drive, memory card, or image;
  2. select Define Area from the popup menu;
  3. enter parameters as required, click OK;
  4. select the newly created entry in the media list and click Continue to proceed to scan settings.

Use cases and alternatives

There are a few cases where you may want to restrict the scan area. Consider these scenarios:

  • There are multiple partitions on a hard drive, and you only need to scan one of these; the hard dirve has its partition table damaged. In this case, the effort is probably better spent reconstructing the partition table (with TestDisk or a similar tool). If partition tables cannot be rebuilt, then you have a valid use case for scan area restriction.
  • The memory card was formatted and then partially overwritten with new files; you want to reduce the scan area to reduce scan time. Theoretically, new files are written from start to end of the media. In practice, this is not always so. If the filesystem is mountable, it is better to create a VHD/X image of the entire media, mount it, and the use Only search unallocated space mode. This way, the exclusions are more precise, and you are still working with the image so the original media is still safe.
  • You know the files you need are located in a certain area of the media, and you want to reduce the scan time. I recommend that you use locality settings instead.

Special considerations - resuming from autosave

When you define the area, write down the parameters you use and keep them until the recovery is complete. If you need to resume the scan from the autosave file, you will need to define exactly the same area on the same media again. You should to this when prompted to select the media while loading the save. Autosave does not store area definitions.

Force 512 bytes per cluster

If enabled, the automatic cluster size detection algorithm will be inhibited and Klennet Carver will use 512 bytes per cluster.

  • The scan will be significantly slower. Overall, scan time is proportional to 1/N2, where N is cluster size. I employ various tricks to make it faster, but still the analysis time will increase by the factor of 50 to 100.
  • Because less data is available per step to base decisions on, there will be more errors in recovery. I expect results to be significantly worse, losing at least one in four recoverable fragmented files.

Use cases

The only legitimate use case I can think of is a recovery of a mangled flash memory dump, where clusters are no longer a meaningful concept.

Allow misalignment

If enabled, allows detection of files not starting on a sector boundary, something that never happens on a regular media.

  • Signal to noise ratio in initial analysis will decrease. This may cause significant loss of otherwise recoverable files.

Use cases

Similar to the previous entry, this should only be used with badly reconstructed flash memory dumps; if you are not analysing a flash dump produced by specialized hardware, do not use this setting.

I have a low volume mailing list, for news and tips, which I send out once or twice a month.
Subscribe if you are interested.