Home

The view sector is a very useful function to get a feel for the state of a disk.  A significant feature of the screen display is that for certain types of sector, the contents will be enhanced with a tool tip, ie a pop up message describing the information.  The number of sectors that will be described will grow as the program develops.

The sector number is entered in box at the bottom of the screen. Any number may be entered, and the sector will be displayed as quickly as possible.  To enter a number in Hex, prefix the number by 0x, eg 0x101  will display sector 257.

There are two options,

Cluster mode

In this mode, blocks will be read as clusters, depending on the operating system being used.  Thus on a FAT disk, cluster 2 is the start of data section.  The blocks are then shown as the cluster length, rather than the sector length.

Expand

Expand mode is for compressed NTFS disks.  The data will be expanded, and displayed in expanded mode. The sectors are expanded u conditionally, and so a non compressed sector will expand to undefined results.  However, a sector that has been compressed will expand correctly, assuming the viewed sector is the start of the compression block.

Save...

The save functions allows a sector to be saved as a file.  The files is a straight copy of the sector, so this is an easy way to dump hard drive sectors. If a complete dump of a drive or disk is required, then the Image and raw recovery mode should be used

Very slow reading

When a disk is failing, it is very common for a read to take a very long time (several seconds) before either coming up with a valid sector, or a failed sector.  A sector displayed with just 5AH is a way that is used to indicate a failed sector. Occasionally, by jumping to a completely different location, and back, reading may be achieved quicker.  Other approaches maybe to turn the drive off for a few minutes to cool down.

Copy function

The standard Windows copy function, Control C, can be used to make a copy of the sector contents. The area of the sector to be copied to the clip board must first be highlighted, it can then be saved in another document or e-mail with the Paste or Control V function. This can be useful if there is a problem that needs reporting.

Update

Occasionally errors can be seen that are due to incorrect values on a sector.  Recovery could be possible, but only if the sector is changed.  A CnW rule is that no sector on a disk must ever be changed, but this does not apply to a disk image.  If the hex values are edited, then the sector can be saved to the disk image.  Forensically, any change must be noted.  There is always a question asking if the sector is to be updated, and this will enable the update to be aborted.