Other products

What are Quick, Deep, and Physical scans and how do I use them?

Norton Utilities Recover Lost Files feature is designed to recover lost or deleted files.

You can perform the following types of scans to scan and recover lost files.

Quick Scan

The Quick Scan is the easiest way to start looking for files. This type of scan is suitable for finding deleted files on the working volumes that are assigned with a letter, for example C:\ D:\.

The Quick Scan searches the selected drive for the entries that are marked as deleted in the Master Files Table (on NTFS volumes). The MFT is a table which all files that are kept by Windows.

For other file systems their metadata is used.

A Quick Scan supports all Partitions with FAT (FAT12 & FAT16), FAT32, and NTFS; all other partitions that are unknown to Norton Utilities continue to proceed, but returns no result. After an entry is found with a Quick Scan, Norton Utilities checks whether the space on the disk that is pointed to the MFT entry is already in use by real data and Norton Utilities attempts to recover what is left.

If the volume has been formatted, the file system records are gone and a Quick Scan may not find any deleted files.

Deep Scan

A Deep Scan searches for lost files in the unallocated clusters that are not referenced in the file table. An unallocated cluster is a cluster that has not been used to store a file. The deep scan engine identifies these files by their unique headers and footer.

A Deep Scan works on FAT12, FAT16, FAT32, and NTFS file systems. It works on drives and partitions with any file system. A Deep Scan requires the volumes to have a drive letter assigned to them.

A Deep Scan not only searches for files by their header/footer; it also uses a set of algorithmic methods and file structure knowledge to search for deleted files.

A Deep Scan automatically includes the Quick Scan phase if the volume is currently mounted by Windows and its file system is supported by Norton Utilities (FAT12, FAT16, FAT32, and NTFS).

Physical Scan

A Physical Scan is similar to a Deep Scan, and may be used in the event of a corrupt hard drive. This is useful for recovering files from formatted drives and unpartitioned drives.

The physical scan works exactly in the same manner as the Deep Scan. The integral difference between them is that while a Deep Scan requires a letter to be assigned to volumes, a Physical Scan shows all drives.

A physical scan scans every sector on the physical drive, and is not dependent on any file system. The Physical Scan works over any hard drive. It searches for known file systems (FAT12, FAT16, FAT32, and NTFS) and then tries to find information based on the File Table.

In general, you may attempt the Quick Scan first to recover lost files. If the file you are looking for was not found in the Quick Scan, try again using the Deep Scan.

If you know that the file you are looking for was on a deleted partition, then use the Physical Scan.

How does Norton Utilities determine the condition of the files?

How do I scan for lost or deleted files?

How do I use the Duplicate File Finder?

How do I repair drives?

How do I restore registry backups?

How do I uninstall unused software?

Welcome to Norton Utilities

The solution made it easy for me to handle my issue.

Yes No

Help us improve this solution.

Thank you for helping to improve this experience.

What would you like to do now?

Browse for solutions, search the Norton Community, or Contact Us.

DOCID: v83566250
Operating System: Windows
Last modified: 06/19/2019