Data recovery professionals and digital forensic investigators have been using R-Studio Technician Package as a powerful, reliable, and versatile tool to solve complex and demanding data recovery tasks requiring thorough analysis of file systems. However, many small computer shops and data care businesses, many of which only do data recovery occasionally, tend to feel that the price of R-Studio Technician Package may be higher than the gains it may bring to them.

In response to their concerns, R-TT, Inc. presents a new license type for its professional data recovery product: R-Studio T80+. This is a fully-fledged version of R-Studio Technician that can be used for a certain period (starting from 80 days) for a price comparable to R-Studio Standalone license ($79.99) if the licensee does not need to use it for a long-term period. Besides some advanced technical features, the T80+ license allows the licensee to perform data recovery from third-party storage devices, either for investigation or commercial purposes, which other R-Studio licenses (except Technician) do not allow.

The R-Studio T80+ license is meant for:

• Small data recovery companies and computer shops. They may use a copy of full-featured R-Studio Technician for 1 dollar per day for a data recovery case that requires advanced and sophisticated software. Best of all, they're not required to prolong the license continuously; that can be done as needed.
• Data recovery and forensic training classes. Instructors can use the T80+ license only when they give classes on R-Studio. They don't have to pay for the time they train their student on something else. They can then prolong their licenses when it comes time to resume their R-Studio training.
• Data recovery and forensic professionals. As we mention in our "R-Studio for Forensic and Data Recovery Business" article, R-Studio Technician remains an important asset in many data recovery and forensic labs across the world. Those who have never used R-Studio Technician Package can now try a full set of R-Studio Technician features (like forensic reports, multi-pass and runtime imaging, and integration with supported data recovery hardware) for a relatively small price before upgrading to the Technician package.

The licensed period starts from the day the license has been activated. When it expires, it may be prolonged; either immediately or after some time. The licensee is fully entitled to all updates during the validity period. In addition, the license can be upgraded to an R-Studio Technician permanent license for the initial price difference anytime before the license expires.

There are slight differences between T80+ and Technician Package:
Unlike R-Studio Technician in the R-Studio Technician Package, R-Studio T80+:

• Is licensed only for a certain operating system (Windows, macOS, Linux)
• Requires an Internet connection and online activation

The remaining features are the same, including:

• Commercial and investigative services
• Unlimited temporary installations on any computer, including the customers'
• Forensic reporting
• Support for launching software from a removable device
• Remote data recovery, including over local networks and the internet
• Joint work with supported hardware and software
• Multi-pass and run-time imaging to extract the maximum possible amount of data while minimizing damage to failing drives
• Drive Copy Wizard to copy data from physical and virtual drive objects
• Advanced text and hexadecimal editors

Below we'll show you three examples on how to use R-Studio T80+ for complicated data recovery scenarios:

• Multi-pass imaging of a failing drive.
• Data recovery over network for a device that cannot be easily opened to take its hard drive out of its case. We'll use a Mac Mini computer with an APFS Fusion Drive for this purpose.
• Creation of a very complex RAID (RAID-on-RAID or nested RAID); a RAID5+1 system.

Moreover, these examples may be very helpful for R-Studio Technician, too, as the course of action for it will be the same.

Multi-pass imaging of a failing drive
When a DIY or semi-professional file recovery program creates an image of a drive, it does so sequentially. That means it reads the drive from the beginning to the end by groups of consecutive drive sector reads, known as sector blocks, in one go. When the program runs into an area with bad or slow sectors, it still tries to read this area in full — ultimately resulting in a complete loss of data from this area. To avoid this, many programs automatically switch to reading individual sectors. This method greatly reduces reading speed, although such intensive reading from bad sectors may severely damage the drive surface, its heads, and other drive mechanics. As a result, the drive may die before the program starts reading data from the good parts of the drive.

R-Studio T80+ can use a different imaging method instead: multi-pass imaging. It tries to retrieve data from drive's good parts first leaving bad and slow areas for later. When R-Studio T80+ encounters a bad or slow sector block, it drops it and jumps to another area until it finds a block with no bad or slow sectors. Then it continues reading data until it runs into another bad or slow block, and the process repeats. When the good areas have all been read, the program starts reading data from slow and bad sectors. This approach maximizes the amount of data that can be recovered from a failing drive.

You may learn more about multi-pass imaging in our article "Multi-pass imaging in R-Studio".

To create a multi-pass image of a drive,
1. Select a drive to image on the Device View panel and click the Create Image button.

Click image to enlarge

2. Switch to the Bad sector processing tab, enter the filename, select the image type, Enable multi-pass image creation option and its parameters.

Click image to enlarge

You may read more about them in R-Studio's on-line help page "Multi-pass imaging".

The Drive sector map file is optional for the compressed image type and mandatory for the byte-to-byte and VMDK image types.

You can also change some other imaging parameters on other tabs. R-Studio's online help page, "Images" explains these in more detail.

Click the OK button and R-Studio will start creating the multi-pass image file, showing its progress and statistics.

Click image to enlarge

When the image file is created, you can load it and process it like its physical source.

Click image to enlarge

File recovery from a Mac Mini (Late 2014) through a network
Generally, the best way to provide physical access to a computer's hard drive is to manually disassemble that computer and connect the drive to the computer that hosts the data recovery software. But Apple computers are notoriously hard to disassemble. Moreover, their SSD devices are often hard-soldered into their system boards, which makes such actions difficult or impossible to perform.

There's another way to solve this problem: data recovery over network. In a nutshell, R-Studio can access hard drives on another computer through a network and work with them as if it's physically installed on that computer. To do so, another program, R-Studio Agent, should be running on that computer. You may read more about this concept in our article "R-Studio: Data Recovery over Network".

By the way, there's the third approach to the same problem: to use R-Studio Emergency. You can read more about it in our article, "File Recovery from an Unbootable Mac Computer". But when you use R-Studio T80+, you need to obtain a hardware activation code for each new computer - which may be inconvenient, especially for simple tasks. R-Studio Emergency for the Technician license doesn't have this requirement, of course.

You need to download R-Studio Agent for Mac and write it to a USB flash drive. It's less than 10 MB, so almost any flash drive can be used. You can use a much larger flash drive to store recovered files, but don't forget to format it as an exFAT device if any of the files are larger than 2 GB (a large digital movie, for example.

Click image to enlarge

The computer with R-Studio T80+ and Mac Mini can be connected through any conventional network types (wired Ethernet, WiFi, etc), through a router, or by using a patch cord between two computers.

To recover files from a Mac Mini, do the following:
1. Connect the USB flash drive and double-click the RStudioAgentEn9 file.

The R-Studio Agent window will appear.

Click image to enlarge

2. Double-click the R-Studio Agent.app instead of drugging it to the Applications folder. It will run without installation to avoid copying large data to the system disk.

R-Studio Agent will start and ask for registration. You don't have to register R-Studio Agent for Mac. When working with R-Studio T80+, recovered files can be saved even with unregistered Agent, despite the warning on the Agent.

Depending on the macOS version of the Mac Mini, you may need to add R-Studio Agent for Mac to the system extension to be able to access files on the system disk. Apple has authorized full access for R-Studio Agent for Mac even to the SIP-protected disk(s).

3. Specify the password for incoming connections and remember the TCP/IP port.

Click image to enlarge

You may specify the IP addresses from which the Agent will accept connections. It may be useful when you are going to connect to the Mac Mini through a local network rather than through a direct connection. See the R-Studio online help: R-Studio Agent for Mac for more details.

When all parameters have been specified, click the OK button.

4. Remember the IP address on which R-Studio Agent for Mac is waiting for a connection from R-Studio.

Click image to enlarge

Then go to the computer where R-Studio T80+ is running.

5. Click the Connect button and specify the IP address, port, and password for R-Studio Agent for Mac.

Click image to enlarge

Then click the Connect button on the dialog box and wait for the connection between R-Studio T80+ and the Agent.

6. Inspect the remote computer, find the partition with the files to recover, double-click the partition, and wait for R-Studio to complete file enumeration.

Click image to enlarge

7. Go to the folder with the files that need to recover.

Click image to enlarge

Browse through the files, find the files you want to recover, mark them, and recover the marked files.

You may preview files by double-clicking them

Click image to enlarge

You may read more about file recovery actions and cases on R-Studio on-line help page "Data Recovery Using R-Studio.".

You may save the recovered files either on the local computer or on devices connected to Mac Mini. But don't forget a very important rule:

Data recovery from a complex RAID (a RAID-on-RAID or nested RAID system)
Another example of a complex data recovery case involves data recovery from complex RAID systems. R-Studio has outstanding capabilities in creation of very complex RAID layouts. You may read more about them in our article "RAID Recovery Presentation."

We'll use a RAID5+1 configuration as an example of a complex RAID system. The RAID5+1 layout is a RAID1 (mirror) over two RAIDs 5 layouts.

Click image to enlarge

The RAID configuration to test:

Parents of the first RAID5: three drive images (RAID51_11, RAID51_12, RAID51_13)
Parents of the second RAID5: three drive images (RAID51_21, RAID51_22, RAID51_23)

Both RAID5 configurations have the same layout:
Offset: 2048 sectors
Block size: 32KB
Block table (Right Synchronous):

*PD stands for Parity of Data.

If the RAID parameters are unknown, you might be able to find them automatically or manually. Read our articles "Automatic RAID Parameter Detection" or "Finding RAID parameters".

To create a RAID5+1 configuration, do the following:
1. Load the image files into R-Studio T80+:

Click image to enlarge

2. Create two RAID5 configurations, add the RAID parents to their respective RAIDs, and specify RAID parameters for both.

Click image to enlarge

You may read more about RAID creation and setting RAID parameters on R-Studio on-line help page "Volume Sets and RAIDs".

3. Create a virtual mirror and add the RAID5 configurations to the virtual mirror.

Click image to enlarge

Now the RAID5+1 is created. It may be processed like a real object. Its files can be enumerated, previewed, and recovered.

Click image to enlarge

Conclusions:
R-Studio T80+ is a good solution for small computer shops and data recovery businesses. As our examples have shown, it can solve quite complex data recovery tasks for the affordable price of just US$1/day. This license can be prolonged/renewed when the program is needed again and even upgraded to the perpetual license of R-Studio Technician if necessary.