RecoveryTool is an open source (GPL v3) file recovery software written in Java. It is capable of parsing NTFS and FAT32 file systems, detecting deleted files, and recovering their data.
Low level byte reading: Fast and efficient handling of reading, parsing and restoring bytes directly from a given drive or partition.
- NTFS parsing:
- Reading of the boot sector for file system information.
- Reading of the MFT to obtain MFT records.
- Parsing of MFT record from its bytes to obtain fields necessary for file recovery.
- Parsing of MFT record attributes 0x10, 0x30, and 0x80. Parsing for resident and non-resident 0x80 attributes, allowing recovery from non-contiguous files of arbitrary length stored across the drive.
- FAT32 parsing:
- Reading of the boot sector for file system information.
- Recursive reading from the root directory to find all directories and files, saving only deleted files.
- Long filename handling in the case that a file's name is longer than 8 characters.
Multithreaded: Utilizes multithreading to improve performance and reduce scanning, processing, and recovery times.
File validation: Apache Tika is used to compare a file's MIME data to its original record's extension to verify that the recovered file matches with the expected format.
Logging: Optional logging component to output information to the user as the drive is scanned and processed
Progress Indicators: Real-time progress bars to show information about the scanning, processing, and recovery of files.
Filtering, sorting and searching: Deleted files are displayed to the user in a table which is sortable, searchable, and has filters. The user selects which files they want to recover by clicking on the table row, represented by a checkbox in the first column.
Custom error messages: Custom error messages are displayed in several locations, such as when a user tries to put recovered files on the same drive that is being recovered from.
Two third-party libraries are used in this project:
- Apache Tika is used to analyze MIME data of recovered NTFS files, to check it matches with the original MFT record.
- FlatLAF is used to provide a theme to the application's Swing components.