There are two panels on the program window - left and right.
Left panel displays the status information and the volume map;
right panel allows you to adjust disk I/O settings as you go.
For more information on the disk I/O, refer to runtime control functions.
Volume map is being colored during the scan.
The color of the block is assigned depending on the type of data in this block.
The colors are as follows:
- White - there is nothing in the block, or the block is not yet scanned.
- Red - there is at least one bad sector in the block. The red color has a priority over the other colors.
- Green - the block contains filesystem structures (MFT entries, directory indexes and so on).
- Blue - the block contains file data which ZAR is capable of recognizing.
The analysis typically involves the following steps:
- Raw disk scan, when objects of interest like file or filesystem
fragments are identified.
- Volume parameters detection, mostly computational process
deriving several key volume boot sector entries from the data collected
during raw scan. Note that even if boot sector is present on the volume, the
values will be computed anew anyway. Generally, we do not put much trust
into the single data structure on the damaged volume, for doing so
will make the process prone to "single point of failure" errors.
- Parsing the filesystem, during which the final results are
generated: file and directory lists are collected and sorted to reconstruct
the folder tree.
Please avoid making estimations about the time of processing based on the
information displayed, for the following considerations:
- Presence and location of the bad blocks has an immense effect on the
raw scan speed, even if the bad block avoidance is configured in
bad sector processing options.
- Some recovery steps may be computationally and/or memory intensive.
ZAR solves quite sophisticated equations to achieve proper
recovery. The complexity of these equations depends upon the state of the
volume being recovered and the time needed to solve them is thus hardly
Note that it may take some time to abort the analysis run (either by pressing
"<<Back" button or by exiting the application). Delay of up to five seconds even
on a decent machine does not indicate a malfunction. The internal state of the
software is quite complex and may take quite a long time to clean it up and
relinquish any unneeded resources.