Complete
Metadata and content validation pass; recovered with the original name and directory.
User Guide
Usage guide
Stop writing to the media that lost data before scanning. ssd keeps the source read-only; choose a different disk or folder as the recovery destination.
Choose a source
Block device (USB / SD / external disk), any folder, or an iOS local backup.
Scan
Quick scan reads metadata; deep scan carves by signature; ext4 can be scoped.
Preview
Chunked reads, never whole-file loads. Confirm the content before recovering.
Recover
Three destination checks, item-by-item export, final counts and a failure list.
Scan modes
Quick first, deep only if needed
Quick scan relies on file-system metadata. Deep scan carves by file signature in unallocated regions; it takes longer and results carry a lower quality grade.
| Mode | Best for | What it recovers | Limits |
|---|---|---|---|
| Quick scan | Recent deletions, metadata intact | File names, directory structure, timestamps | Cannot recover after overwrite |
| Deep scan | Metadata already gone | JPEG / PNG / MP4 / PDF carved by signature | No name / path; graded “carved-only” |
| Folder recovery | Backup folders, old-drive copies | Deleted items in a directory source; subtree preserved | dir: is rejected under an elevated session |
| Scoped path scan | Large ext4 devices | Deleted items inside a chosen subtree | ext4 only; other file systems are rejected explicitly |
Pause and resume: scans can be paused, resumed or cancelled. Checkpoints and item counts are persisted together; after a process kill or restart, the scan continues. A ≤4 MiB window around the checkpoint is rescanned, and records are replaced with equivalent entries by ID (idempotent).
Results & preview
Every result carries a quality grade
Possibly damaged
Metadata exists but the content chain is incomplete; the recovered file may not open fully.
Carved-only
Rebuilt from the file signature; no original name or path. Completeness follows the carved boundary.
Results page
- Pagination and filtering by type, quality and size
- Multi-select and batch recovery; per-item status and failure reason
- Preview images, text prefixes or info cards; large files are read in chunks
Preview before recovering
Preview never writes to the source. Images are assembled from chunks and damaged items are flagged; text reads only a prefix, so the whole file is never pulled into memory.
Safe export
The export chain does two things: write to the right place, never touch the source
Three checks
- Different device: the destination must not be the source (Windows volume number / macOS IOKit whole-disk ownership / Linux device number).
- Existing files: a same-name file in the destination marks that item failed; never overwritten, never deleted.
- Free space: insufficient space refuses the export instead of writing a partial file.
Dropped-privilege worker
- Exports run in a separate worker with privileges dropped; privileged access never writes into the user directory.
- Directory sources preserve their subtree; duplicate names inside a group get
_2 / _3suffixes. - Cancellable in real time; final report has success / failure / degraded counts plus a per-item list.
- Symlink write-through is checked level by level and rejected; never writes back to the source.
Trial & license
Try first, decide later
A license-free trial allows 20 files / 1 GiB. The desktop build adds a trial anchor: first-run network time; trial = 7 days from the anchor ∧ at most 3 export sessions.
Trial
- 20 files / 1 GiB without a license
- Desktop: 7 days ∧ 3 export sessions, layered with the quota; first limit wins
- Before anchoring, trial export is unavailable; failed time requests are silent and retried on the next launch
License
- Validity, export count and exported bytes can be limited separately; first exhausted limit blocks export
- One license, one machine: first activation binds the physical NIC MAC; no MAC means no activation
- Activation performs one network time check; over 10 minutes off Beijing time is refused
Verify code
- “Generate verify code” on the license page: local, zero outbound, zero disk writes
- A new code is generated on every click; opening the page does not generate one
- Randomized NIC (LAA) or unreadable NIC ⇒ refusal
- Send the code to the seller for purchase or machine-change reissue
Note: license counters are bound to the license; re-importing the same license does not reset them. Changing the quota requires a new licenseId. A new NIC requires a reissue. Manually changing the clock may end the trial early or require activation.
Command line
xd-cli · pro edition
Links directly to the engine (no daemon). stdout is JSONL; progress and notifications go to stderr. Write commands cannot run without the two-phase flow.
Read-only & scan
xd-cli device list
xd-cli scan start --source /dev/sdb
xd-cli scan status <id>
xd-cli scan results <id>
xd-cli export start --scan <id> --dest ~/recoveredImage & write-back
xd-cli image create --device /dev/sdb --out disk.img
xd-cli image verify disk.img
xd-cli image restore --prepare --image disk.img
xd-cli sector read --device /dev/sdb --offset 0 --length 512Write commands need two phases: --prepare is a read-only rehearsal that prints a token; --prepare --commit completes both phases in one call. --yes only skips prompts and never generates or reuses a token.
Network & privacy
Zero outbound from the engine; exactly three touchpoints
① Update check
Manual check from settings; automatic check on launch is on by default and can be disabled. One static GET, no query string, no cookies, no machine identifier; 24 h throttle, silent failure, no download and no auto-update.
② First-run time anchor
Before anchoring, each launch makes one silent HEAD request (Date response header only; three hosts in random order). On success it anchors, then makes zero outbound requests. Not controlled by the update switch.
③ Activation time check
Clicking “Activate” performs one Beijing-time request (same three-host pool, once only). If it cannot be reached, activation is refused (fail-closed). Not controlled by the update switch.
Read-only guarantee: the source is accessed read-only; the partition hash is unchanged before and after a scan. Exports never write back to the source. The Android build has zero INTERNET permission. The engine (crates/) is unrelated to all three touchpoints.
FAQ
Frequent questions
Why can’t I find a file I just deleted?
It may already be overwritten, TRIM may have run, or the metadata is gone. Stop writing, then try a deep scan. If it is still missing, software recovery may not be possible.
Why does a deep scan show no file names?
Deep scan carves by signature and does not use directory entries. It can only provide type and content, not the original name or path. The quality grade is “carved-only”.
Why is the destination rejected?
The destination is on the source device, a same-name file exists, or free space is insufficient. Choose an empty folder on a different disk.
Why can’t the trial export?
The desktop trial requires a first-run network time anchor. Before that, export is unavailable. After anchoring: 7 days ∧ 3 sessions ∧ 20 files / 1 GiB.
Can I use my license on another computer?
No. One license is bound to one machine on first activation via the physical NIC MAC. Generate a verify code on the new machine and ask the seller for a reissue.
Does the app modify my system?
No. ssd does not provide root functionality and does not modify the system; storage partitions are read-only. Linux polkit / udev are used only for read-only elevated access.
