RecoverYantra Imager on the command line

Folder to write the image into (default: ./Evidence)

When to use it. Point this at the evidence store for the case, not at the machine's own disk. On a booted rescue USB the default writes to the stick itself, which is usually what you want in the field.

What it costs. The folder must have room for the whole source. The pre-flight refuses rather than filling the disk half way through.

Retries for bad sectors (default 3)

When to use it. Raise it when the drive is readable but marginal and the case justifies a slow, thorough pass. Lower it to 0 or 1 when the drive is deteriorating and getting a complete-enough image quickly matters more than the last few sectors.

What it costs. Every retry is another read of a failing surface. On a drive that is physically degrading, high retry counts can cost you the areas you have not reached yet.

Start even if the pre-flight checks object.

When to use it. Only when you have read the pre-flight objection and know it is wrong for your situation, for example free space reported incorrectly by a network share.

What it costs. The pre-flight exists to stop a job that cannot finish. Forcing past a genuine space or same-drive objection loses work, and on the same-drive case it can overwrite the very data being recovered.

Engage a SOFTWARE write-block (OS read-only) on the source first. Best-effort and not a substitute for a hardware write blocker; layered with the fingerprint.

When to use it. Use on every evidential acquisition where no hardware write blocker is available. It sets the operating system's own read-only flag on the source before the first read.

What it costs. It is best effort at the operating-system level and is not equivalent to a hardware write blocker. State which one you used in the report; do not describe a software block as a hardware one.

Image format: raw (.img, resumable) or E01. Asked for when omitted.

When to use it. raw when the image will be recovered from or examined on the same bench and a stopped copy must be resumable (the .map carries on); e01 when it goes to a lab that expects Expert Witness containers or when the destination is smaller than the drive and compression has to make it fit. Asked for on screen when omitted.

What it costs. An E01 copy cannot be resumed part way; a raw copy takes the drive's full size on the destination.

On the RecoverYantra bootable USB: offer the USB's own DATA partition and any other attached drive as the destination, never the drive being copied or the boot medium; record the read-only protection.

When to use it. Set by the RecoverYantra bootable USB's own launcher: the USB's DATA partition is offered first as the destination, then any other attached drive that is neither the source nor the boot medium, and the manifest records that every disk arrived read-only.

What it costs. Outside the bootable USB there is no live medium, so the flag is ignored with a note and -o decides where the image goes.

Examiner asserting lawful authority (recorded)

When to use it. Record the individual asserting lawful authority for the acquisition. Required practice for anything that may be produced in proceedings.

Lawful basis: warrant / consent / statutory power

When to use it. Record the lawful basis: warrant, consent, or a statutory power. Write what it actually is, and keep the underlying document with the case file.

What it costs. This field records the assertion. It is not legal advice and it does not create authority you do not have.

Examiner's organisation (recorded)

When to use it. The examining organisation, as it should appear on the report and in the custody record.

Case / FIR reference (recorded)

When to use it. Your own case or FIR reference. Set it at acquisition so every later artefact carries the same identifier.

What it costs. Adding it afterwards means the earliest records in the trail carry a different reference from the rest.

Raw device path (e.g. \\.\PhysicalDrive1 or /dev/sdb)

When to use it. Run the feasibility check the moment a drive arrives, before quoting, before imaging and before any promise to the client: it measures how much of the drive is unreadable and states the chances in plain words.

What it costs. A few hundred sampled reads - seconds on a healthy drive, and one gentle attempt per area on a failing one. Far cheaper than discovering mid-copy that the job was never viable.

An existing image file to check instead

When to use it. Check an existing image instead of a drive - for example to confirm a copy received from a client or another lab reads cleanly before work is billed against it.

Also write the answer as a PDF report at this path

When to use it. Write the verdict as a PDF wherever a client, insurer or case file needs the answer on record. The report states its numbers as ranges and says it is based on a sample.

How many areas of the drive to test (default 160)

When to use it. More samples narrow the stated range and cost more reads of the drive. The default suits a first assessment; raise it when the estimate must be tighter than a few percent.

What it costs. Each extra sample is another read of a drive that may be dying. On clearly failing hardware, keep the default and move to the copy.

A filename, part of one, or a wildcard (e.g. IMG_2019, *.jpg)

When to use it. Search every usable attached device for a file whose name matches PATTERN, without picking a drive first. Free, no licence needed - reads each device's index in seconds, the same tier as `--list`. Use it when the customer cannot say which of several drives holds what they want.

Give up on one drive after this long (default 20); a slow or failing drive never holds up the others

When to use it. Seconds allowed per device before moving on. A slow or failing device costs only its own row - the sweep never waits on one device at the expense of the rest.

List every drive checked, including the ones with no match

When to use it. Also sweep devices that are not in a normally-usable state, where possible. Use it only once the plain sweep has come back empty.

Write the guide as a self-contained, searchable HTML page

When to use it. Produce the manual as a single searchable page to hand to a client, put on an internal share, or carry onto an air-gapped bench.

Write the guide as Markdown

When to use it. Produce Markdown when the content is going into your own documentation system or version control.

Show what has been acknowledged on this install

When to use it. Show what lawful-use acknowledgements have been made on this install. Useful when auditing a shared bench machine.

Forget remembered acknowledgements (history is kept)

When to use it. Clear the remembered acknowledgements when a machine changes hands or a new operator takes it over.

What it costs. The history is retained. Resetting does not erase the record of what was previously acknowledged.

Raw device path (e.g. \\.\PhysicalDrive1 or /dev/sdb)

When to use it. Recover directly from the attached drive when it is healthy, the job is not evidential, and time matters.

What it costs. If the drive is failing, image it first. A direct scan reads the whole surface and can be the read that finishes a dying drive.

Disk image file (.dd/.img/.iso)

When to use it. The default choice for anything evidential, anything failing, and anything where the original must be returned untouched.

An iOS (iTunes/Finder) backup folder (Manifest.db)

When to use it. Point at an iTunes or Finder backup folder when the handset itself is unavailable, locked, or must not be touched.

Storage Spaces slab-map JSON: reassemble a pool virtual disk from member images and recover from it

When to use it. Reassemble a Storage Spaces virtual disk from member images and recover from the assembled volume.

Output directory for recovered files (required unless --list)

When to use it. Always a separate drive from the source. The product refuses a destination on the drive being read.

smart=metadata+carving (default), fs=named files only, carve=signatures only

When to use it. Leave at smart. It parses the file system for original names and folders AND carves free space for what the metadata no longer covers. Use fs when you want named files quickly from an intact file system; use carve on formatted or badly damaged media where the metadata is gone.

What it costs. fs alone misses everything the file system no longer indexes. carve alone returns files without their original names or folders. smart is what maximises the result.

Carry on from where an earlier scan of the same source into the same output folder stopped, instead of starting again from the beginning

When to use it. Continue a scan that was stopped, on the same source into the same output folder. A large drive is an overnight job and does not need to be restarted.

What it costs. The checkpoint belongs to the DRIVE, not the path. A different disk in the same slot restarts from the beginning, with the reason stated.

Also recover currently-existing (non-deleted) files

When to use it. Add whenever the loss is a volume rather than a deletion: a reformatted disk, a RAW volume, a failed array. In those cases the files were never deleted and the default deleted-only view will look almost empty.

What it costs. It substantially increases the output size, because it recovers everything present as well as everything deleted.

Print the drive's folder tree from its index (live and deleted files) and stop. Fast; nothing is written. -o is not needed.

When to use it. Look before you scan. Reads the filesystem index only and prints the folder tree - live and deleted files, deleted ones marked - in seconds, writing nothing. Use it first on any drive whose index is intact: it tells you whether the folder the customer wants is still named, so you can recover that alone with --only instead of reading the whole drive.

What it costs. Free, and needs no licence. What it cannot show is anything whose index entry is gone - a formatted card, a wiped table - which still needs the full scan.

Recover only this folder or file (repeatable). Paths are the volume's own, e.g. --only /Users/jo/Documents/ --only /Photos/IMG_0042.jpg. Implies --mode fs and --include-intact.

When to use it. Recover one folder or file rather than everything: the customer wants the Documents folder, not four hours and a terabyte of working folder. Repeat the switch for several paths; a folder path takes everything under it, and 1:/Folder/ names the folder on partition 1 only. Paths are the volume's own, as --list prints them.

What it costs. Implies --mode fs and --include-intact. Every content check, the manifest and the organising run exactly as in a full scan; a use is still charged for the drive.

native=built-in (default), photorec=use TestDisk's PhotoRec, auto=PhotoRec if installed

When to use it. Leave at native. Select photorec only to cross-check a result with a second implementation, which is occasionally useful in a disputed matter.

What it costs. The external engine must be installed separately and does not carry this product's validation or its verdicts.

Carving processes: 0=auto/all cores (default, byte-identical output, ~3x faster), 1=single-threaded, N=that many

When to use it. Leave at 0 so the carve uses the available cores. Set 1 when you need the machine responsive for other work, or when reproducing a result exactly for a report.

What it costs. Output is byte-identical either way; only the time changes. Below about 128 MB the product stays single-threaded because process start-up costs more than it saves.

Bytes per sector (default 512)

When to use it. Change from 512 only for 4K-native drives, where the wrong value prevents the volume being recognised.

Unlock an encrypted drive. A BitLocker 48-digit recovery password, a LUKS passphrase, or a key in hexadecimal.

When to use it. Supply the BitLocker recovery password, LUKS passphrase or hex key for an encrypted volume.

What it costs. Without the correct credential the volume cannot be read by anyone. The product states that rather than returning fragments. The credential is not retained for a later resume.

Start even when the pre-flight checks say this cannot finish: too little room, or writing onto the drive being recovered.

When to use it. Only when you have read the pre-flight objection and established that it is wrong for your situation.

What it costs. The two objections it can override are both serious: too little room means the scan stops part way, and writing onto the drive being recovered overwrites the data you are trying to get back.

Generate a recovery report after scanning (comma-separated: pdf,docx,html; default all)

When to use it. Generate the report at the end of the scan whenever the result goes to somebody else: a client, an insurer, or a case file.

Override the mode for this run (forensic=hash+manifest+evidence, recovery=fast+by-type). Defaults to the saved global mode.

When to use it. Override the saved mode for this one run, for example a single evidential job on a bench normally used for commercial recovery.

What it costs. Setting it per run avoids the more common error, which is leaving a bench in forensic mode and hashing every file on high-volume commercial work.

List the APFS snapshots on the source (point-in-time views that may hold deleted/overwritten files) and stop

When to use it. Run first on any Mac volume. Snapshots are point-in-time views that often still hold the file as it was before it was deleted or overwritten.

Recover files as they were in this named APFS snapshot (byte-exact from the copy-on-write extents)

When to use it. Recover from the named snapshot. Where the file exists in a snapshot, this returns it byte-exact and is far better than carving for it.

List the Windows Volume Shadow Copies on the source (previous versions - originals from before deletion or ransomware) and stop

When to use it. Run first on any Windows volume, and always in a ransomware incident. Shadow copies hold previous versions from before the deletion or the encryption.

Recover files as they were in this shadow copy: the snapshot-time volume is reconstructed and scanned

When to use it. Reconstruct the volume as it was at that snapshot and recover from it. This is frequently the fastest complete recovery available.

What is happening, in plain words (e.g. "drive is clicking"); omit to list every situation

When to use it. Describe what is happening in your own words - "drive is clicking", "formatted the wrong disk", "Outlook will not open it" - and get the feature to use, why that one rather than the obvious alternative, a worked example, the commands, and what NOT to do. Use it when somebody hands you a job and you are not sure which part of the product it belongs to, and give it to new staff before you give them anything else.

Show every situation, grouped, rather than searching

When to use it. List every situation, grouped, instead of searching. Use it to see the whole range at once - useful when scoping what a product will cover for a customer, and for training.

What it costs. Situations the product you are running does not include are marked, so the list stays honest about what this build can actually do.