The first entry screen for CnW is where the media is selected, and typically the type of recovery. It also allows going straight to the main recovery tools.
To select a physical drive
On program start up, the list box at the top left is filled with all possible drives. If a drive is selected, very brief details are shown below. Also, at this point, the types of functions possible are enabled. The box below gives a very brief description of the drive with partitions and total drive capacity.
It is not possible to select Drive C: or Phys-0 as these are normally the system drive. Recovery should never be attempted on a working system drive as temporary files etc could be written to the disk at any time and potentially overwrite any lost files. To recover such files, the disk must be set up as slave drive on a different PC
User name and job reference
These parameters are used in the log, and and as a selection basis for the forensic report
Main Functions
Recovery functions and other options
The main menu is where all the basic recovery tools can be accessed. There are options to configure recovery functions and modify certain parameters. When a drive has had major failure, or corruption, it is not always possible to determine the exact original configuration exactly, but CnW will allow these relevant values to be entered manually. All the basic recovery functions are selected from this main menu
Data carving
Data carving is the process where a disk of any format may be searched for possible files, based on the file signature. Files are then saved in subdirectories based on file type. This works with all types of media but should be treated as a second option as file names and directory structure is not retained.
Create drive image file
This creates an image file of the media. It is in effect a Unix DD file with a one for sector sector mapping. Blank and unreadable sectors are padded. Incremental imaging may be performed with this function.
Forensic image and scan (under development, due December 2013)
This is a forensics only option. The function will optionally create a disk image file, and then scan for all files, and optionally take hash values of the files, and unallocated space.
Recovery Wizards
Before any routine is run, there is a very simple physical drive test to try and detect if there are significant errors on the drive.
Memory chip photo recovery
For the majority of memory chips, this will be a simple one stage operation. The memory will be analysed, and files recovered. During the recovery process thumbnails of photos will be displayed. This is also an option to help process fragmented files
Failing hard drive
This process will first create an image file of the disk, and then call the relevant recovery routine.
CD/DVD recovery
This function calls the CD recovery function
Mini DVD video
It is very common for mini DVDs to become unreadable. Sometimes due to being taken out of the camera. This function will analyse the disk and produce a complete video file.
Corrupted drive
This wizard calls the main recovery routine with the best settings to read a corrupted drive.
AVCHD memory chip
The recovery scans a memory chip and reconstructs all fragments from AVCHD files
Repartitioned drive
This is a wizard to be used when a drive has been repartitioned. Attempts will be made to estaiblish any previosu partition
Formatted drive
This is a wizard to work on a drive that has been reformatted. The drive is analysed to determine if the drive has had the logical file system changed.
MP4/3GP Recovery
This function does a comprehensive scan of the disk or memory chip and will attempt to reconstruct MP4 video files.
DOCX and Zip recovery - under development
The disk or memory chip will be scanned and all Zip files reconstructed. Fragmented files will be joined and corrupted files will be reconstructed to create a valid ZIP file, but may not be complete
AVI Recovery - under development
AVI files are typical video files from cameras. Being typically FAT32, these suffer from fragmented files and the wizard will help reconstruct such files. AVI is also sometimes used with security camera software.
PC Sleep / hibernate mode
When CnW Recovery is recovering files, the sleep / hibernate mode of a PC is inhibited. This means that long recovery process can be started and they will not be truncated by maybe a 2 hour 'sleep' policy on a PC.