ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Disk Explorer

From ForensicsWiki
Revision as of 17:47, 27 November 2006 by CeleryGod (Talk | contribs)

Jump to: navigation, search

DiskExplorer is a forensic tool that can be used by investigators to analyze file systems. The file systems supported by DiskExplorer are:

  • FAT12
  • FAT16
  • FAT32
  • NTFS

DiskExplorer for FAT file system can accomplish the following tasks:

  • Navigate through your drive by using browser-style back and forth arrows, by going directly to the partition table, boot record, FAT or root directory, by jumping to a certain sector etc.
  • Switch between several views, such as hex, text, directory, FAT, partition table and boot record view
  • Search your drive for text, boot records, partition tables and sub directories
  • Investigate the volume' s boot record by looking at the volume information
  • Edit your drive by using the direct read/write mode (not recommended) or the virtual write mode
  • View and recover even deleted files
  • Create a virtual volume when your boot record is lost or corrupted
  • conduct your own data recovery by taking advantage of all these features