Home

This option is used to read the media at a very basic level from which either

• A complete image of the media may be made,
• Image can be built up incrementally

The image mode can either be as a copy of the disk for security reasons, or because the disk has a large number of sector errors.  If there are a large number of sector errors, a disk image may be constructed in sections, with the ability to skip bad areas of the disk.  The file extraction tools are the same as recovering from any physical disk, with any operating system.

The image file created is in effect a DD format (as used in Unix/Linux).  There is always a one to one mapping of each sector.  For failled sectors, the image file is padded with 0x5A ('ZZZZ')

The displayed menu has a section where the media may be determined – which may help in calculating the correct size. The size of the scan – in sectors, may be entered by hand and this is typically used when one section of the media has become unreadable, for instance the start of the end of the media.  By default, the program will try and read the whole disk.

The options allow extracting files in different ways, including allowance for compressed, or partially compressed NTFS disks

Raid Disks

When the Raid enable is selected, the image file will be produced in a striped format, allowing both sections of the raid to be logically placed. Full details see Raid Disks

Status

When doing a drive scan, status details are displayed.  This will include the sectors read, and sectors failed.  If the data is being split, it will also give the number of files discovered.  The progress bar at the bottom of the screen will also indicate how far through the disk has been scanned. It will be discovered that sometimes the system appears to be extremely slow, and this is normally related to a high number of bad sectors. Unfortunately, there are not many ways over this problem, but the following suggestions may assist.  It should be noted that it is always possible to cancel the copy, and the start again at the same location

• First suggestion is to cancel copy (but not current sector), and turn drive off.  Once cooled down it may be possible to start again at the same location
• The second suggestion is to skip a section of the disk.  Note where the copy has reached, and cancel copy.  Start copy again, but make the start sector a high value. Write to the same output file, and the program will pad the apparent gap with sectors filled with 05AH. At any time later, it is always possible to follow a similar procedure, and start again in the area that was giving problems

On an NTFS disk that is reading very slowly, it may be worth while after reading the first few MB, to start the image at the start of the MFTs.  This value is displayed in the Recover option menu for NTFS. Please read the next section on recovery methods

A curious observation of slow disk reading is that for some disks, it will sometimes suddenly speed up, and may even continue at high speed to the end of a disk. Patience can sometimes be rewarded with a lot of data, but at other times, no significant progress is made.