Difference between revisions of "Disk Explorer"

From ForensicsWiki
Jump to: navigation, search
 
Line 1: Line 1:
DiskExplorer is a forensic tool that can be used by investigators to analyze file systems. As of now , the file systems supported by DiskExplorer are: <br>
+
DiskExplorer is a forensic tool that can be used by investigators to analyze file systems. The file systems supported by DiskExplorer are: <br>
<ul><li>FAT12</li>  
+
<ul>
<li>FAT16</li>
+
<li>
<li>FAT32 </li>
+
FAT12</li>  
<li>NTFS </li></ul>
+
<li>
 +
FAT16</li>
 +
<li>
 +
FAT32</li>
 +
<li>
 +
NTFS</li>
 +
</ul>
 +
 
 +
DiskExplorer for FAT file system can accomplish the following tasks:
 +
<ul>
 +
<li>
 +
Navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, FAT or root directory, by jumping to a certain sector etc.</li>
 +
<li>
 +
Switch between several views, such as hex, text, directory, FAT, partition table and boot record view</li>
 +
<li>
 +
Search your drive for text, boot records, partition tables and sub directories</li>
 +
<li>
 +
Investigate the volume' s boot record by looking at the volume information</li>
 +
<li>
 +
Edit your drive by using the direct read/write mode (not recommended) or the virtual write mode</li>
 +
<li>View and recover even deleted files</li>
 +
<li>Create a virtual volume when your boot record is lost or corrupted</li>
 +
<li>conduct your own data recovery by taking advantage of all these features</li>
 +
</ul>

Revision as of 13:47, 27 November 2006

DiskExplorer is a forensic tool that can be used by investigators to analyze file systems. The file systems supported by DiskExplorer are:

  • FAT12
  • FAT16
  • FAT32
  • NTFS

DiskExplorer for FAT file system can accomplish the following tasks:

  • Navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, FAT or root directory, by jumping to a certain sector etc.
  • Switch between several views, such as hex, text, directory, FAT, partition table and boot record view
  • Search your drive for text, boot records, partition tables and sub directories
  • Investigate the volume' s boot record by looking at the volume information
  • Edit your drive by using the direct read/write mode (not recommended) or the virtual write mode
  • View and recover even deleted files
  • Create a virtual volume when your boot record is lost or corrupted
  • conduct your own data recovery by taking advantage of all these features