Quick scan · deleted files
Reads file-system metadata to recover names, directory structure and timestamps. Best for recent deletions that have not been overwritten. Results carry a quality grade.
Capabilities
Features & iterations
From the M0 foundation to the M5 pro edition, every layer serves one goal: recover what can be recovered without damaging the source, and be explicit about what cannot be recovered.
Recovery
Four scan paths for different failure scenarios
Deep scan · file carving
Recovers by file signature when metadata is gone. JPEG / PNG / MP4 / PDF structure validation reduces false positives, with honest truncation and a “carved-only” grade.
Recover from a folder
Use any folder as a source (dir: source) — useful for backup directories and copies of old drives. Exports preserve the subdirectory tree.
Scoped path scan (ext4)
Scan only a subtree on large devices (scan.start path); deleted files inside the subtree are recovered normally. Other file systems are rejected explicitly, never silently widened.
Engine matrix
Six file systems, one read-only path
As long as the device appears as a block device, it follows the same read-only path. Every engine has synthetic fixtures, an external oracle, or a kernel e2e gate.
| File system | Typical media | Core capability | Status |
|---|---|---|---|
| FAT12 / 16 / 32 | USB drives, SD / TF cards | SFN + LFN directory entries, chain reads, contiguous fallback | Available |
| exFAT | Large USB drives, camera cards | Directory-entry set validation, NoFatChain contiguous reads | Available |
| NTFS | External drives, Windows disks | Full $MFT parsing, unused records, $Bitmap grading | Available |
| ext4 | Linux disks, Android storage | jbd2 journal overlay, scoped path subtree | Available |
| f2fs | Android internal storage | Parsing, deleted-file recovery, recovery-rate gate | Available |
| APFS | macOS disks | Object headers / omap / B-trees, snapshot view | Available; real-device chain pending |
UI & delivery
Four pages, one safe export chain
Four-page UI
Device / folder source → scan → results → preview → recover. Pagination, filters, quality badges, multi-select and a per-file report.
Export safety chain
Separate dropped-privilege worker; three destination checks (different device / no overwrite / free space); never deletes existing files; symlink write-through is rejected.
Chinese / English
Follow the system or switch manually; changes take effect immediately. Contract copy is shared across three surfaces, including the store description and the in-app capability page.
Licensing & pro edition
Issued per need, enforced per license
Trial & licenses
- Trial: 20 files / 1 GiB; desktop adds a 7-day ∧ 3-export-session anchor.
- A license can limit validity, export count and exported bytes separately; the first exhausted limit blocks export.
- One license, one machine: first activation binds the physical NIC MAC; if the MAC cannot be read, activation is refused (fail-closed).
- Activation performs one network time check; a deviation over 10 minutes refuses activation.
- Verify code: generated locally, zero outbound, zero disk writes; used for purchase or machine-change reissue.
M5 pro edition
- Disk images: create, companion manifest, verify, restore; two-phase commit + one-time token + five gates.
- Sector editor: read / write / undo stack; a snapshot is written before any write, otherwise the write is refused.
- Batch jobs: serial executor, resume after daemon kill, conflicts rejected instead of queued.
xd-cli: a thin shell over the engine with the same two-phase and audit discipline as the GUI.- Write capability exists only in the separate
xd-writerbinary; daemon / xd-cli contain zero write symbols.
Mobile
iPhone backup parsing is in
Import an iTunes / Finder local backup, parse its structure, then browse, preview and export items by type. The encrypted-backup chain (keybag / PBKDF2 / RFC 3394 / AES-256-CBC) is implemented in the core; the password stays in memory and is never written to disk.
Honest boundary: items deleted after the backup was taken are not in the backup and are out of scope. Current verification uses synthetic backup samples; real-device backups are pending. Android root block-device scanning is only a skeleton and is shown as “not connected”.
Architecture
UI and engine are fully separated
The Flutter UI owns state and presentation only. On desktop, the engine runs in a separate privileged daemon over line-oriented JSON-RPC on stdio. A UI crash or daemon crash cannot take the other down.
Frozen contract
proto/v1 is the single source of truth. Rust and Dart both decode and encode the same golden cases; a contract change must update three surfaces together.
Read-only as a type
BlockDevice has no write interface. The recovery path cannot reach write capability; two executable gates pin this: the write-surface manifest and the binary symbol table.
Process isolation
daemon, export worker and xd-writer are separate processes. Pending requests wake with errors if the daemon dies, and the UI can retry.
Lifecycle & request cycle
Two processes, one stdio pipe
Iterations
From foundation to pro edition
Milestones move in order: read-only first, then recovery, then productization, then the pro edition. Every capability has a test or gate instead of a review memory.
M0 · Foundation
v0.1.0Contract, read-only device abstraction, end-to-end handshake
- JSON-RPC envelope, read-only image backend, stdio daemon, Flutter skeleton
- Contract v0 frozen; Rust and Dart golden assertions on both sides
M1 · First end-to-end
v0.2.0 → v0.4.0FAT / exFAT, carving, four-page UI, platform closure
- Scan orchestration, file carving, chunked preview, export and cancel
- Three-platform elevated sessions, Windows / macOS platform layers, installers
M2 · Desktop trio
v0.5.0NTFS, ext4, MP4 / PDF carving
- NTFS $MFT parsing and $Bitmap grading; ext4 jbd2 journal overlay
- Windows / macOS / Linux installers and smoke tests
M3 / M5 · Productization & pro
v0.6.0Licensing, updates, release pipeline; write-back engine and CLI
- Offline signed licenses, trial quota, three network touchpoints
- xd-writer write isolation, images, sector editor, batch jobs, xd-cli
- f2fs engine and APFS snapshot surface
Rebrand & local recovery
v0.7.0xiaodun → ssd; folder recovery; English UI
- Install identifiers and system paths unified as ssd
- New
dir:source and Chinese / English UI
Data-safety fixes
v0.8.0Scoped path scan + three safety fixes
- Exports no longer delete existing files; symlink write-through rejected; resume no longer loses scope parameters
- Directory-source exports preserve the subtree
Licensing upgrade
v0.9.0Time / count / size quotas, one license one machine
- Activation time check; no MAC means no activation
- Issuing tool and quota fields land
Mobile
v0.10.0iPhone backup import and parsing
- Manifest.db parsing, encrypted-backup core, in-app import / preview / export
- Android build hardening; root mode still not connected
Trial anchor & delivery hardening
v0.11.07 days ∧ 3 sessions; scan failure reasons surfaced
- First-run network time anchor; SSHSIG checksum signature
- Absolute-path validation unified; Windows 10/11 support statement
v1.0 series
v1.0.0 → v1.0.3One-machine verify code, full rebrand, about-page fix, all-in-one deb
- Verify code generated locally, zero outbound, zero disk; new key per release
- v1.0.1 full rebrand; v1.0.2 about-page version injection fixed
- v1.0.3 deb ships the desktop app; dpkg install yields the GUI
Boundaries
What ssd cannot do
These are the unsolvable-at-the-software-level cases and the parts not yet verified. Stating them is more useful than promising “everything can be recovered”.
Unsolvable in software: physical media damage (controller failure, lost firmware), hardware-encrypted drives, TRIM already executed on SSDs / cards, and heavy overwrite. Stop writing to the media immediately after data loss.
Not yet verified: real USB / camera-card end-to-end paths, real UAC / polkit / FDA dialogs, Windows / macOS real-device paths, APFS real-device raw disk and Apple production snapshots, Android root real-device chain, real iPhone backups.
Android note: ssd does not provide root functionality and does not modify the system. Android root block-device recovery is a “not connected” placeholder; non-root source is not implemented. On Android 10+ (FBE), deleted file content usually cannot be recovered.
