Disk scan

Home

The disk scan function (forensic option only) will scan a disk, sector by sector and indicate where data has been stored. There are several categories of data it will detect, and can be selected by the user.

The serial number is the drive serial number as set by the manufacturer. This should be a unique number. The drive reference is made up of the drive name and serial number. This is used by default for the report name.

The types of sector detected are

Blank sector - there is no data in this sector
Bad sector, was unreadable
Partition starts - this was a sector such as a partition sector, or BPB
Directory files, eg a MFT entry, or FAT directory
File start - has found a recognisable signature
Text data. The data is largely text
Compressed data. The data is largely compressed. This could be for JPEGs, video files, ZIP files, and sometimes programs, .exe, .dll etc

When the check box is selected, or changed, the display will be updated. This way the colour of each data type can be seen clearly

When the cursor is clicked on the chart, the left hand box is filled in with possible file start data. In the example above it shows XML and WP4 amongst others. The number is the hex value for the sector analysed.

As an option feature when scanning, the a disk image can also be created. Unlike the standard disk image function it does not pad files when the sector range does not start at zero. It means that this method of imaging is not suitable for incremental imaging. As the function makes a lot of use of parallel processing, it is fast.

Create report

When the disk is scanned, the basic results are stored in the log - mainly in the forensic section. Also an XML report is automatically generated. It is stored in the log directory, typically c:\cnwdata\reports. The report can be viewed using Internet Explorer and the associated style sheet (disk_report.xls) is also required.

The report displays the basic information and (soon) will display images of the distribution of each type of sector found.