Klennet Carver settings
File formats to search for
You can choose specific file formats to search for in the left panel.
Normally, leave all of them enabled.
If you do not need some specific file type, and you know there are many files of that specific type on the media,
turning off the scan for these formats may make the analysis faster.
However, deselecting one of the formats increases the uncertainty area to analyze, which may cause analysis
to slow down instead.
If you are recovering a memory card, leaving all file types enabled will be faster,
even though you may not need some of them.
Cache policy
Klennet Carver uses a two-tiered cache, first caching data in RAM and
then optionally on a system temporary drive.
The default cache settings are good enough in most cases.
For details, look at the cache settings reference.
General settings
Enable autosave
If enabled, Carver will save a checkpoint every once in a while,
so if the power goes out, you can resume the recovery.
Limit the number of parallel threads
You can use this to limit CPU usage somewhat.
Maximum value allows Klennet Carver to use all available CPU cores.
Smaller values leave more CPU available for you, trading off analysis speed.
The maximum value corresponds to the maximum number of threads your CPU can run in parallel.
This is the same as the "Logical processors" count in the Task Manager, Performace tab, CPU section.
Only search unallocated space
If you scan a mounted volume (which has a drive letter) and this option is active,
Klennet Carver will query the filesystem driver for a map of clusters that are in use on the media.
These clusters are then excluded from the analysis.
If you do not have the actual media or if you do not want to mount it,
use VHD or VHDX disk image to mount the image of the media.
Suppose the filesystem is not damaged, and you are looking for deleted files.
In that case, the cluster map provided by the driver is accurate,
and scanning only unallocated areas of the media will save time.
If the filesystem is damaged (in recovery cases other than deleted file recovery),
the cluster map may be inaccurate, and you should use this option with caution.
Locality restriction
Locality restriction limits the search for the next fragment of a file
to the vicinity of the last known fragment of that file.
The distance is defined as a percentage of the total media size.
Restricting locality provides speed improvement up to 100 / (Lback + Lfwd) times.
For example, if the backward locality is 5% and the forward locality is 20% (for a total of 25%), the maximum speed up is 4x.
Restricting locality is only useful if you are working with a hard drive.
I recommend that you have it unrestricted in both directions on a memory card.
Locality settings; the green area is to be scanned.
Locality settings apply to images and videos. Recovery of ZIP files does not honor locality restrictions.
Cluster chain smoothing
This setting is used to correct minor reconstruction errors by smoothing small gaps in block order,
as illustrated in the example below.
Cluster chain smoothing.
In this example, a file consists of two fragments, the first fragment containing clusters 1 to 14
and the second one clusters 15 to 32.
However, during reconstruction, clusters 22 and 23 are erroneously placed into the red-shaded position,
while the correct placement is shaded green.
During smoothing, Klennet Carver determines that reassigning these two clusters to a green position
will produce a large contiguous fragment.
If the threshold is set to or above two clusters, the clusters are reassigned.
Cluster chain smoothing improves recovery quality, especially with video files.
Image settings
These settings apply to all supported image file formats.
Maximum reasonable image size
This setting controls the initial guess for the image size.
Get all your existing shots you took with the same camera, and look for the largest one.
This will give you the maximum actual image size.
Then, select the lowest possible setting which is still larger than the maximum actual size.
This setting only affects carving time.
The result should still be the same, but the correct setting will cut the run time by a couple of hours for a memory card.
Minimum image megapixel size
This setting only applies to fragmented files.
Klennet Carver will recover contiguous files below the megapixel threshold
but will summarily drop fragmented files with a resolution below the threshold from the results.
One case when it is handy is when your high-megapixel camera stores low-resolution JPEG thumbnails in separate files
alongside high-resolution images.
If you are only going after high-resolution images, set this to about 3 megapixels so that carver does not search for
fragmented thumbnails. Doing so will cut the processing time somewhat, sometimes by up to 20%.
Maximum bifragment gap clusters
This parameter controls the maximum gap size for bifragment gap carving.
Higher values require more analysis time.
Settings below 16 are not effective in most cases.
Anything above the default value of 256 is probably counterproductive because of slowness and decreased reliability.
Size is measured in multiples of filesystem cluster size.
If you need a forensic recovery, leave this setting at zero.
Video settings
Enable header stealing
If enabled, Klennet Carver will use video file headers (and sometimes frames) found on the media to reconstruct files with missing headers.
This only works with memory cards, where all videos are shot with the same camera settings.
For more details, refer to the video recovery page.
Enable video preview
Only available on Windows 10.
Enables the video preview and video thumbnails whenever possible.
Klennet Carver uses a small number of initial frames of the video file to create a thumbnail;
if the video is mostly black in the beginning, the thumbnail will also be mostly black.
Minimum MPEG2 and MP4 frames
Any sequence of MPEG2 or MP4 frames smaller than the specified value will be discarded when performing header stealing.
MPEG2 uses more frames than MP4. Recommended settings are 10,000 for MPEG2 and 100 for MP4.
If you need to extract something really short, like half a second of a video, change the appropriate setting one step lower.
However, this often causes a drastic increase in unusable output.
ZIP settings
Maximum analysis time per file
ZIP files can be big, and validating these big files takes a long time.
Recovery time for ZIP files is proportional to the size of the file squared (known in programming as O(n2)).
Therefore, it is easy to encounter a ZIP file that requires an impractically long time to process.
A cut-off time is imposed to prevent this.
If Klennet Carver cannot reconstruct a ZIP file within a given time, it stops and considers the file unrecoverable.
This also applies to ZIP-based document files (MS Office DOCX, XLSX, PPTX); these are typically recovered in under a minute.
More settings
There are some more settings that I recommend you avoid and do not actually use.
These settings are described on the additional settings page.