Which feature do I need?

I deleted files and emptied the Recycle Bin

• The files are not in the Recycle Bin
• The drive is otherwise working normally
• It happened recently and little has been written since

Use: Recover lost or deleted files in RecoverYantraSuite

Deleting a file removes its directory entry, not its contents. The sooner you read the drive, the more of it is still there - and the first thing that matters is to stop writing to it.

Read the drive, write the results somewhere else.

I formatted the wrong drive

• Windows offered to format it and I said yes
• The drive now shows as empty
• It has the right capacity but no files

Use: Recover lost or deleted files, in smart mode in RecoverYantraSuite

A quick format writes a new, empty filing system over the old one. It does not erase the files themselves, so both routes are open: the old structures often survive, and anything they miss can be found by its contents.

Read the old structures AND search by content, in one pass.

I need the photos and messages off a phone

• The phone works and unlocks
• You want the camera roll, chats or call history
• Nothing has been deleted, or something was deleted recently

Use: Get data off a phone in RecoverYantra Mobile

A phone cannot be read like a disk, so this copies what the phone itself will hand over, and reads the app databases where deleted rows often still sit.

What can be recovered from which app, before you start.

Read one app's store and show the rows that were deleted.

I don't know which of my drives has the data

• An external drive, an old laptop disk in a caddy and a couple of USB sticks are all attached at once
• You can describe the file - a name, roughly when it was made - but not which drive it is on
• Guessing wrong costs a full scan of a drive the file was never on

Use: Search across every drive at once in RecoverYantraSuite

A filesystem index reads in seconds and needs no licence; run over every USABLE attached drive it answers the question that comes BEFORE "recover from which drive" - the one the product otherwise assumes you can already answer. Each drive is only read once for its listing, so checking four candidates costs a couple of minutes total instead of committing hours, and a use of the licence, to the wrong one first.

See every attached drive first, with its state and why any of them is not usable, before searching a single one.

Read one drive's index by name - the free, licence-free first look this situation is built on. Repeat for each candidate drive until the name turns up; a single sweep across every listed drive at once is the same engine call, one drive at a time.

The recovery finished but which of these is the one I actually wanted

• A finished recovery with tens or hundreds of thousands of files on screen
• You remember roughly when it was, roughly what kind of file, and part of the name - not the exact path
• The results grid is too big to scroll through by eye

Use: Find the one file you actually wanted in RecoverYantraSuite

The scan already recovered everything (the product never narrows a scan up front), so this is a filter on the results you already have, not another pass over the drive. It answers with the three things a customer can actually say - roughly when, roughly what kind, roughly what it was called - and shows RC1's trust grade (good / mismatch / empty / unknown) beside every match, so you are never sent to open a file that will not.

Filter by category and part of the name; the date range narrows further on the results screen.

I ran CHKDSK and now files are missing, or the drive looks empty

• Windows offered to 'Scan and fix this drive' after an error, or you ran chkdsk /f yourself
• The drive now looks like a normal, working volume - not RAW, not asking to be formatted
• Folders that used to have files in them are empty, or the whole drive looks empty

Use: Recover lost or deleted files, in smart mode in RecoverYantraSuite

A repair tool can rewrite the index into something that still looks like a valid volume while pointing at the wrong place, so the drive stops asking to be formatted but also stops showing what it has. This reads the volume as it is now, and automatically tries the volume's own untouched spare copy of that index whenever the first read comes back essentially empty - nothing is written to get there.

Read the volume as it stands now; the spare index copy is consulted automatically when the primary names almost nothing.

Also carve by content for anything neither copy of the index reaches.

The drive is clicking, or very slow, or gives read errors

• A repeated click, beep or grinding
• The computer freezes when it is plugged in
• Copying starts and then stalls

Use: Copy (image) a failing drive in RecoverYantraSuite

A dying drive has a limited number of reads left in it. Imaging takes the easy data FIRST and only then returns to the difficult areas, so you get the most out of it before it stops - and every scan afterwards runs against the copy, not the patient.

Check the drive's health before you touch it.

Copy it gently: few retries, easy data first.

The drive does not show up at all

• Nothing appears in Explorer or Disk Management
• It may not spin up, or the light does not come on
• It worked yesterday

Use: Find out why the drive will not read in RecoverYantraSuite

There are four links between plugged-in and readable, and only two of them are ours. Being LISTED is never proof of being READABLE, so this actually reads a sector at each end before saying anything.

Say which link in the chain is broken, and whether it is ours.

The computer will not start, and the files are on its internal disk

• It fails before Windows loads
• You cannot get to the desktop to install anything
• The disk itself is probably fine

Use: Build a rescue USB in RecoverYantraSuite

The disk is usually healthy; it is the machine that will not start. Working from a USB means the broken system never runs, so nothing writes to the disk you are recovering.

Prepare a stick that really boots.

On the booted machine: pick a disk and image it.

Windows says the drive needs formatting, or shows it as RAW

• 'You need to format the disk before you can use it'
• The drive shows 0 bytes, or the wrong size
• It was working and now is not

Use: Recover lost or deleted files, using the spare boot sector in RecoverYantraSuite

Usually one small structure has been damaged, not the data. Every filing system keeps a SECOND copy of what it cannot live without, and reading that spare copy often turns an unreadable drive back into a full list of files with their real names.

Falls back to the spare copies when the primary structures will not parse.

A NAS or RAID array has failed

• Two or more disks that were one volume
• The box will not rebuild, or rebuilt wrongly
• You have the disks but not the controller

Use: Recover from a RAID or NAS in RecoverYantraSuite

The array's layout - order, block size, parity rotation - can be worked out from the disks themselves, so the original controller is not needed. Each member is only ever read.

Work the layout out from the disks and show what is on it.

Recover from the reassembled array.

A virtual machine will not start, or its disk is damaged

• A .vmdk, .vhdx, .vdi or .qcow2 file
• The hypervisor refuses it, or the guest will not boot
• Snapshots may be involved

Use: Recover from a virtual machine disk in RecoverYantraSuite

A virtual disk is a filing system inside a file. Reading the container gives access to the guest's own volumes, so the guest never has to start for its files to come out.

Read the guest volume inside the container.

The drive is encrypted and I have the password or recovery key

• BitLocker, LUKS or FileVault
• You have the recovery key, password or keyfile
• The volume will not mount normally

Use: Recover from an encrypted volume in RecoverYantraSuite

Everything on the drive is unreadable until it is unlocked, so this has to come first. Unlocking happens in memory against a read-only source: the drive itself is never modified.

Unlock read-only and recover in one pass.

Outlook will not open the mailbox file

• 'The file is not an Outlook data file'
• Outlook reports it as damaged
• A .pst or .ost that used to work

Use: Recover a mailbox in RecoverYantraSuite

Outlook calling a file damaged MEANS the structures a normal reader depends on are gone. So the file is swept for the messages themselves, and each candidate is validated by its own contents rather than by an index that no longer exists.

See what is in it before writing anything out.

Read it if it is healthy, sweep it if it is not.

A database file will not attach or open

• SQL Server, MySQL, Postgres, Oracle, SQLite or Access
• The server refuses to attach or start
• You need the rows, not the server

Use: Recover a database in RecoverYantraSuite

The rows are stored on pages inside the file, and those pages survive damage that stops the server. The rows can be read straight out of them - including rows that were deleted, which come back flagged so they can never be mistaken for live data.

Identify it and say what can be extracted.

Write the rows out, deleted ones flagged.

A recovered video plays sound but no picture, or will not open

• The file is there and is roughly the right size
• Audio plays, the picture is missing or frozen
• VLC opens it but Windows Media Player does not

Use: Repair videos that will not play in RecoverYantraSuite

A video's index says where every frame is. If it is damaged, or was written last and lost, players cannot find the picture even though it is all there. Rebuilding the index is enough - and where frames really are missing, it says so instead of claiming a repair.

Rebuild the index and correct the header, working on copies.

Use a healthy file from the same camera for the hard cases.

I need footage off a security recorder's hard drive

• A disk out of a Hikvision, Dahua or similar NVR or DVR
• Windows says the disk is unformatted
• The footage may have been overwritten by newer recording

Use: Recover surveillance video in RecoverYantraSuite

Recorders use their own layouts, which is why a PC calls the disk unformatted. The video is found by its structure instead, and each clip is written so it will actually play on its own.

Confirm it is a recorder disk before committing hours.

Find and extract the clips.

I only need one camera between two times off the recorder disk

• The recorder disk or its image is here
• The incident is one camera and a known hour
• Nobody wants nine days of every channel

Use: Recorder view in RecoverYantraSuite

The recorder's own index is read in seconds and nothing is written: cameras down the side, time across, played straight from the disk. A cut of one camera between two times is remuxed losslessly with a sidecar naming the extent and the three times, so the whole disk is never carved for one hour of one channel.

List the cameras and their times from the recorder's own table (--json or --csv for a file).

One camera, one range, lossless, with its sidecar.

Copy a clip byte-exact with its digest.

I found something on one machine and need to know where else it is

• A file, a hash or a phrase turned up in one place
• There are hundreds of machines and you cannot image them all
• You need to know which machines are worth acquiring

Use: Sweep the estate in SakshyaYantra Forensic Suite

Imaging four hundred machines to answer one question is not an investigation, it is a year. A sweep asks every enrolled endpoint to look on its own disk and report yes or no. The data does not move; what comes back is the short list worth acquiring.

Follow ONE file by its exact hash - the copy that left, not merely something with the same name. --root narrows where each endpoint looks, so hundreds of machines finish while you are still in the meeting.

Find password vaults nobody declared, by filename or pattern.

A phrase inside files. Bounded by size and file type on purpose, or a sweep becomes a full-text index of somebody's laptop.

Acquire only the machines that had hits.

A seized phone is locked and I need a full forensic image, not a backup

• The phone is evidence, not a consenting owner's handset
• A backup or "get the photos" pull is not enough for the case
• You need to know BEFORE touching it whether a method exists for this exact chip

Use: Full mobile acquisition (checkm8 / Qualcomm EDL / MediaTek BROM, by device) in SakshyaYantra Mobile Workbench

Which method reaches a locked phone depends on its exact chip, not its brand, and the honest answer for a current flagship is often none in software. A plan is run BEFORE anything touches the device, so the examiner knows which method applies and what it needs, or that none does.

See every method the Mobile Workbench carries: in-house protocol, detected external tool or licensed package, and its certification.

Rank the methods that reach THIS exact device, honestly, before anything is touched.

Files have been encrypted and there is a ransom note

• Files renamed with an unusual extension
• A note demanding payment
• It may still be spreading

Use: Recover from a ransomware attack in RecoverYantraSuite

Some of what looks encrypted is not: files that were only renamed, partially encrypted, or whose originals survive in shadow copies, temporary files or free space. Those come back with no key and no payment. What genuinely is encrypted is said to be encrypted.

Find what comes back with no key at all.

Identify the family and give an honest plan.

I need to acquire a machine that cannot be switched off

• A production server, or a machine in use
• Powering it down costs more than the investigation
• You need a consistent copy, not a smear

Use: Live acquisition in SakshyaYantra Forensic Suite

The volume is frozen at one instant and THAT is imaged, so the copy is a single point in time even though the machine keeps running. A plain read of a live disk is an image of no single moment: databases half-written, files half-copied.

Ask what it has and whether it can be frozen.

Acquire it while it runs.

I need to acquire a staff machine without going to it

• The machine is at another site, or with the person
• Collecting it would announce the investigation
• The organisation owns and administers it

Use: Endpoint agent and roster in SakshyaYantra Forensic Suite

An agent deployed with the rest of the fleet software means acquisition is a decision rather than a project. Machines report in, so you pick one from a list instead of scanning.

Build the pushable installer, with the console baked in.

See what enrolled, and what can be reached right now.

I need to know what somebody did on this computer

• Which files were opened, copied or deleted
• What was plugged in, and when
• Which programs ran

Use: Forensic examination and timeline in SakshyaYantra Forensic Suite

Windows records far more than most people expect - the recycle bin, the change journal, prefetch, the registry, shortcuts, event logs, jump lists, shellbags and browser history. On one timeline they answer questions no single artefact can.

Examine the verified image, hashing everything.

Put the artefacts on one timeline.

The data is in Microsoft 365 or Google Workspace, not on a disk

• The estate is mostly cloud
• You need a mailbox or a drive, not a machine
• The organisation owns and administers the accounts

Use: Authorised cloud acquisition in SakshyaYantra Forensic Suite

After an attack on a largely virtual estate the cloud IS the estate. The organisation's own administrator authorises it, the scope is recorded before anything is collected, and mail arrives as .eml so it opens anywhere.

Ingest the administrator's Purview or Vault export.

I am selling, returning or scrapping a drive

• The drive leaves your control
• It held personal or company data
• You may need to show it was cleared

Use: Securely erase a drive in RecoverYantra Wipe

Deleting and formatting leave the data in place. Overwriting every block does not - and this then runs the recovery engine over the result, so the certificate says what was actually achieved rather than what was intended.

Overwrite, verify with our own recovery engine, and issue a certificate.

I need to show that I did not alter the evidence

• The work may be reviewed or challenged
• A client, auditor or court will ask
• You need more than an assurance

Use: Write-block verification and the audit trail in SakshyaYantra Forensic Suite

This engine has no write path to a source at all - but that is an assertion, and an assertion is not evidence. So the source is fingerprinted before and after the job, the audit trail is hash-chained so an edit or deletion is detectable, and the report states which regions were checked rather than claiming the whole drive.

Run the tool's own validation against images whose contents are known.

Check the trail is unbroken, including anything cut off the end.

The recorder export will not play, and it is evidence

• A .dav, .h264 or vendor file from a DVR
• Windows Media Player and VLC refuse it or show green
• Nobody has hashed it and the station needs a certificate

Use: Bring the footage in through the decode ladder in SakshyaYantra Forensic Suite

Recorder exports are the vendor's own container, and a normal player gives up at the first thing it does not know. The ladder tries the container, then the index, then the raw stream, then salvage - and records which rung produced each frame, so what you show later can be traced to this file.

Decode it through the ladder to another drive.

Record the intake with the examiner named.

The court wants the frames that show the vehicle, with the time

• A specific moment in a long recording
• A request for stills the defence can check
• The video itself must not be handed out

Use: Capture a frame pack in SakshyaYantra Forensic Suite

A screenshot has no provenance. A frame pack has every frame with its presentation ticks, its decoded index, the overlay clock as text, the source hash and the frame's own SHA-256, plus a hashed manifest - and it is the only unit that ever leaves the machine.

The timeline: frames, keyframes, gaps.

The pack.

Re-hash it before it leaves.

The other side says the clip was cut or faked

• A claim of editing, re-encoding or synthesis
• A file with no known history
• A court that will ask which method said what

Use: Examine authenticity in SakshyaYantra Forensic Suite

One score convinces nobody. The workbench runs every method - structure, codec history, double compression, frame statistics, the optional model packs - reports each result or refusal, and ranks the hypotheses with the methods for and against each. The examiner writes the conclusion.

Every method, the ranking, the record in the case.

I need a clip off the recorder with the time on it, playable, and a still for the report

• The clips are already extracted from the recorder disk
• One customer or insurer needs ONE exact clip, not the whole extraction
• The report needs a still frame, and it has to be somebody's exact moment, not a screenshot

Use: Play, cut and hand over CCTV clips in RecoverYantraSuite

The Suite carries the same player, clip download, custom-download and enhance the forensic family has (R-CCTV-PARITY) - because a recovery customer wants a playable, timestamped clip just as much as an examiner does. A custom cut is remuxed losslessly by default (the recorder's own compressed pictures, not re-encoded), and only becomes an exact-frame re-encode when you ask for it and the screen says every pixel is now new.

See the recorder's own camera x time table before extracting anything.

Cut straight off the disk, by camera and time, with no separate recovery step first.

Hand over one clip exactly as carved, SHA-256 verified.

Cut the range that matters, losslessly by default.

A few stills for the report or the claim form.

A written report of clips, channels, times and hashes.