Frequently asked questions

Does PhoinixDR write to my disk?

No. The block layer has no write primitive, so no component of the recovery engine can modify a source (ADR-0002, ADR-0007). The only writes are recovered files, reports and sessions, and the recovery writer refuses a destination that lives on the source disk.

Why does a file show 0 % / "Unrecoverable"?

No extent of its content could be located: the filesystem cleared the file's layout on deletion and no journal copy survived (ext2, an ext4 journal that wrapped), or the record is damaged. The name and timestamps are still shown because they are evidence of the file's existence. A deep scan may still find the content by signature; carved hits that start where a metadata candidate expects its data are merged into it.

The scan of my USB stick shows "Unrecoverable" for everything but one file.

On large FAT32 volumes the Windows driver clears the high half of the first-cluster number when deleting. PhoinixDR infers the real start from the free clusters and their content (explain prints "start was inferred"). Make sure you are running a current build; the fix ships since the M7 follow-up.

What does "allocated to active filesystem data" mean?

The clusters a deleted file used are now marked in use by other files. The old bytes may or may not still be there; PhoinixDR reports allocation as evidence of reuse and lowers the likelihood accordingly, but never claims "overwritten" without proof.

Likelihood versus confidence?

Likelihood estimates the probability that recovery returns the original bytes. Confidence says how much evidence that estimate rests on: a scan with content examination off, a file without a structural validator or an unknown medium lowers confidence without changing the likelihood. See the health model.

Why do I need administrator rights? Is there a way around it?

Reading \\.\PhysicalDriveN (Windows) or /dev/sdX (Linux) is a privileged operation on both systems, so scanning a device directly means running PhoinixDR as administrator (or with sudo) and recovering in one step. You do not have to start it that way: when a device shows as not accessible, the Restart as administrator button asks the system for elevation and restarts PhoinixDR elevated. The alternative is to image the device first with an imaging tool and open the image in PhoinixDR, which then needs no elevation; the imaging tool needs it instead. See two ways to recover.

The desktop application does not start on Windows.

It needs the WebView2 runtime, which is part of Windows 10 21H2+ and Windows 11. On an older or trimmed installation, install Microsoft's WebView2 Evergreen Bootstrapper. The command-line phoinix.exe has no such dependency.

Which version do I have?

The desktop executable carries the version in its file name (PhoinixDR-0.1.2-windows-x64-portable.exe) and in its file properties (Details tab), and shows it next to the author in the top bar. The command line prints it with phoinix --version.

SmartScreen or an antivirus warns about the executable.

SmartScreen is a reputation system: it warns about any executable whose publisher has little history of clean downloads, which is the case for a new project. Press More info → Run anyway, and compare the SHA-256 with SHA256SUMS.txt from the release (or build from source). The release workflow signs the executables as soon as a code-signing certificate is configured, and reputation then accrues to that identity release after release; no certificate removes the warning instantly, not even an EV one, as Microsoft's own guidance now states. See Code signing and SmartScreen. Antivirus heuristics may also flag a program that reads raw disks; the same checksum answers that.

Can I recover from an SSD?

Rarely, and PhoinixDR says so before you scan. Windows tells an SSD which blocks a deleted file occupied, and the drive discards (TRIM) them within seconds; from then on they read as zeros even though the filesystem record still describes the file perfectly. No tool can read past that. Recovery from an SSD works only when TRIM was not in effect: a USB enclosure that does not pass it through, TRIM disabled, or data lost through a reformat before TRIM ran. The scan setup page shows a warning for solid-state sources, and every candidate's content is sampled for zeros regardless of the Examine content option, so a discarded file shows a low likelihood with the reason "zero-filled" instead of an intact-looking record.

Which filesystems and images are supported?

NTFS, FAT12/16/32, exFAT and ext2/3/4 with undelete; any other volume can be deep-scanned (carved). Sources: physical disks, RAW/dd, split RAW, E01/split E01/SMART, VHD, VHDX and VMDK images. HFS+, APFS, XFS, Btrfs and RAID/LVM are on the roadmap.

Is the recovered file identical to the original?

When the layout is known and every cluster is free, yes, and the SHA-256 in the recovery output lets you check it against any hash you have. When some clusters were reused the file is written as it is now, marked with its allocation evidence, so that you can judge it.

Where are sessions stored?

In the user's local application-data directory (%LOCALAPPDATA%\org.phoinixdr.desktop on Windows, ~/.local/share/org.phoinixdr.desktop on Linux). They contain the scan results and evidence, never file content. Delete the directory to remove them.

Can PhoinixDR repair a partition table or a filesystem?

No. Lost partitions are mounted virtually and recovered from; the table is never written (ADR-0011). Repair tools change the disk you are trying to recover from and are out of scope by design.

What does the Advanced checkbox do?

It shows the technical detail behind the interface without changing the scan or the recovery: the phoinix command equivalent to the current scan and to the selected file, a live log of what the engine is doing, the candidate's filesystem reference, the structure validation checks and a diagnostics block. See Advanced mode.

How do I get a log for a bug report?

Tick Advanced before scanning; the scanning page then shows the engine log with a Copy log button, and the results page keeps Copy scan log. On the command line, run the same command with -vv and attach stderr. Either way the log describes structures and counts, never the content of your files. Add the phoinix explain output for the file in question and, when you can, an image of the volume.

Is one overwrite pass enough to erase a disk?

Yes, on any drive made this century. Multi-pass schemes (DoD 5220.22-M, Gutmann's 35 passes) come from 1990s drive encodings; Gutmann's own epilogue calls the full method "pointless for any drive", and NIST SP 800-88 states that one overwrite protects drives made after 2001 against both keyboard and laboratory attack. PhoinixDR offers the multi-pass methods because some policies still require them, and shows a warning that links El mito de Gutmann when you choose one.

Can PhoinixDR wipe the free space of a disk without erasing it?

Yes, since M12.2. Deleting a file frees its clusters and leaves the data there, which is what recovery relies on; a free-space wipe overwrites those clusters and nothing else. From a disk's erase page choose Only the free space of partition N (the volume is read with the recovery engine's allocation map, needs administrator rights and must not be in use), optionally with the slack at the end of every file; or pick a volume in use from the second list on the erase page, and PhoinixDR fills it through the filesystem with no administrator rights and removes the fill files at the end. Either way an optional post-erase scan looks at the result with the recovery engines and the certificate records what it found. What is not reached (small files kept inside NTFS MFT records, journal copies, shadow copies, remapped flash cells) is stated on the page and in the certificate.

Can PhoinixDR erase individual files?

Yes, since M12.3, and it tells you what that is worth. The files you choose (or every file under a folder) are overwritten through the filesystem with the method you pick, named streams and slack included, read back, truncated, renamed and deleted. But overwriting a file by name, as the author's Borrado seguro de archivos explains, does not reach the copies the system keeps: journal versions, shadow copies, temporary files, the page file, backups, the old resident bytes of an NTFS record, remapped flash cells. The page and the certificate say so, and the honest sequence is to erase the files and then wipe the free space of their volume.

Can PhoinixDR securely erase an SSD?

Yes, since M12.4, with the drive's own sanitize command. An overwrite reaches an SSD's logical blocks, not its physical cells: the controller remaps writes, and over-provisioned or retired cells are never touched, so an overwrite is NIST 800-88 Clear. A Purge is the command the drive runs itself: ATA SANITIZE (crypto scramble, block erase) or SECURITY ERASE, NVMe Sanitize or Format with a secure-erase setting. PhoinixDR asks the drive what it offers, preselects it on a solid-state drive, samples blocks before and after to check that they changed, and says when the command is not reachable (USB bridges, the Windows inbox NVMe driver) or the drive is frozen (sleep and wake the computer, or replug the drive's power). Otherwise, physical destruction.

How was PhoinixDR built?

With extensive AI assistance and deliberate engineering. Read the Development Declaration, Yes, PHOINIX is vibecoded and Where PHOINIX Came From.