SkyFire RecoveryHow It Works
Three modes. One engine.
Simple for people who just need their files back. Advanced for power users. Forensic for professionals who need everything documented and verifiable.
Simple for people who just need their files back. Advanced for power users. Forensic for professionals who need everything documented and verifiable.
The same Rust-based sector reader powers every mode. The interface changes — the engine doesn't.
Simple Mode
Guided recovery for non-technical users
Select a drive. Recovery scans it and shows you what's recoverable. Pick the files you want. Save them. The scan engine underneath is the same Rust-based sector reader used in Forensic mode — the interface just removes everything you don't need.
Best for
Advanced Mode
Full recovery scan with file browser
See the filesystem tree including deleted files. Carver runs on unallocated space finding files by their signatures. Hex viewer for inspecting raw sectors. Fragmented file reconstruction with adjacency scoring.
Best for
Forensic Mode
Everything in Advanced plus full chain-of-custody discipline
Every operation logged to a hash-chained audit log. Write-blocked acquisition. Ed25519-signed manifest. Court-admissible output bundle.
Best for
Three levels, each adds depth. Recovery starts at Level 1 and escalates automatically.
Level 1 — Filesystem parse
Recovery reads the filesystem metadata directly — APFS B-tree traversal, NTFS MFT record parsing, HFS+ catalog B-tree, exFAT directory chains, FAT table, ext4 inode table. Deleted files are found here because deletion typically marks space as available without immediately overwriting the data.
Level 2 — Signature carving
Recovery scans unallocated space sector by sector looking for file signatures — the magic bytes that identify a file type. 40+ signatures, including internal structure validation (a JPEG isn't just confirmed by its header bytes — the internal structure is verified). Each carved fragment gets a confidence score.
Level 3 — Fragmented reconstruction
When a file's data is spread across non-contiguous sectors, Recovery uses adjacency scoring across six dimensions — LBA proximity, entropy continuity, role coherence, size plausibility, overlap detection, read-error rate — to assemble the most likely reconstruction. Every gap is logged, every synthetic byte is documented.
Four strategies, each for a different scenario. Recovery selects the best fit automatically, but you can override.
Header/Footer Carve
Use detected header and footer to bound the file. Zero-pad unreadable gaps. Best confidence when header and footer are both found.
Fragment Join
Stitch contiguous known extents. Mark gaps as synthetic. Used when filesystem metadata gives partial cluster chains.
Reference Assist
Provide a reference copy of the file (e.g. a backup, another copy). Recovery fills unreadable sectors from the reference, overlays your recovered data on top. Every byte from the reference is marked SYNTHETIC in the output. Confidence score reflects how much of your data vs. reference data made it into the result.
Structural Rebuild
For container formats (ZIP, PDF, MP4, SQLite): rebuild the structural skeleton. Reconstruct ZIP central directory from local headers. Rebuild PDF xref table. Reassemble MP4 fragments with moov box validation. Page-align SQLite to page boundary.
Separate from reconstruction. For files that open but are corrupted — Recovery repairs the structural metadata so the file becomes readable again.
Recovery reads SMART data and runs surface tests. Health scoring identifies drives at risk before they fail completely. If a drive is failing, Recovery prioritises imaging it before attempting file-level recovery.
Recovery already supports Reference Assist — give it a reference copy of a corrupted video and it fills the gaps. What's coming: automatic internet fingerprinting.
Recovery will extract a snippet from the readable sectors of the corrupted file, generate a perceptual fingerprint, search for a match, and — when found — use the matched file as the reference automatically. No manual hunting for a reference copy.
Corrupted movies, TV episodes, home videos backed up elsewhere: Recovery finds the source and reconstructs faster than any purely local approach. This is a consumer feature, not forensic — reference-assisted reconstruction with internet lookup.
Personal recovery or professional forensics — the engine is the same.