The Sophistication Level is a unique feature of GetDataBack to balance the need to collect relevant information against the time it takes to do that. The concept allows for a measured approach to a drive. It is our goal to scan the "bad drive" for what is needed for the data recovery to work, while ignoring uninteresting or unpromising areas on the drive.
There are four distinct levels. Level 1 provides the fastest scan, while level 4 does a complete scan of the drive. For any level other than 4, GetDataBack generates a list of areas of interest (LAI).
The LAI includes:
GetDataBack's smart scan algorithm looks for Streaks and continues scanning adjacent sectors if structures of interest, such as MFT entries, are encountered. Such a Streak is considered to have ended after nothing of interest was found in NoStreak sectors. NoStreak for Level 1 is 0, so GetDataBack does not try to find adjacent structures in Level 1.
The final parameter to understand is the Thieve width. It is applied to Level 3 only and adds 8 sectors every Thieve sectors to the LAI. Let's say you have a drive with 1,000,000,000 sectors and a Thieve width of 100000. The sectors 0-7, 100000-100007, 200000-200007, etc., are added to the LAI, assuring that the entire drive is probed for interesting structures.
| LEVEL | PURPOSE | LAI BRACKET | LAI NOSTREAK | LAI THIEVE | Scan Time*) File Systems | Scan Time*) Recovery Tree | Total Time*) | Sectors Read*) |
|---|---|---|---|---|---|---|---|---|
| 1 (*) | Mount file system, fastest | 100 | 0 | No | 3 seconds | 4 minutes | 00:04:03 | 0.28% |
| 2 (**) | Intelligent file system scan and recovery, fast | 1000 | 16 | No | 30 seconds | 4 minutes | 00:04:30 | 0.32% |
| 3 (***) | Thorough file system scan and recovery | 1000000 | 1030 | Between 10,000 and 100,000 depending on the drive size | 18 minutes | 45 minutes | 01:03:00 | 2.65% |
| 4 (****) | Complete drive scan, find any data trace, slow | ∞ | ∞ | n/a | 6 hours | 1 hour | 07:00:00 | 101 % |
| *)Test HD was a 1 TB SSD, completely filled NTFS partition with 1.3 million active files, 5 million MFT entries. | ||||||||
The table above shows stats for running GetDataBack with different levels. Levels 1 and 2 are very fast, with limited stress on the drive. This reduced stress is a positive factor to consider if your drive has mechanical problems. Usually, drives with mechanical problems should be imaged first, but an image will always (try to) read 100% of the drive. If you only need a handful of files, and can get away with scanning under 1% of the drive, skipping the image might be a proper course of action.
The sophistication levels are cascading. If GetDataBack finds nothing of value in level 1, it continues with level 2, then level 3, and finally the complete scan.
The higher the level, the more cluttered your Recovery Tree is. In data recovery, "more is better" does not always apply, as it might drown the files you are looking for in a barrage of years-old, long deleted, and unwanted information.
If you want to change the sophistication level, you will most likely do so in the Select File System screen. The purple tile in the left bottom shows the current sophistication level. You can change and increase the level by clicking on the purple tile. If you change the level, it is effective going forward. At the same time, the already completed scan between the Select Drive and the Select File System screen is elevated to the higher level by repeating the scan with the increased level.
You can modify the level right from the start in TOOLS->Settings->Data Recovery->Initial level.
See also: Doing a Data Recovery, Checklist, FAQ