Data Compass has been updated to version 6.0 and there are mainly three new features added, which are File Recovery by Type, Access to HD Doctor and File Classification by Type and Date. This article is a case study of those features.
File Recovery by Type (RAW SCAN)
In normal HDD, operating system accesses a file by file system. For example in FAT system, OS access file through FDT (File Directory Table) and FAT (File Allocation Table). However, if file system is corrupted, the OS can’t access file any more. In such case, File recovery by type is needed.
File recovery by type is accomplished by searching file header signature, therefore it is also called File header signature search. This file recovery method searches for files that can be recognized by a characteristic file header signature (a certain sequence of byte values). To understand this, users can open several file with same type (JPEG, DOC etc) with Winhex and compare the header. For example, JPEG file has a header 0xFFD8FFE1 and doc file has xD0CF11E0A1B11AE1. Because of this approach, File Recovery by Type does not depend on the existence of functional file system structures. When found based on the signature, the files are listed into their own subfolder, e.g. JPEG, GIF etc.
To use the feature of File Recovery by Type, users need to right click mouse on device or partition and select that option. After that, users will get a submenu.
Users can select file type you want to search and define the default size of certain kind of file. Right click mouse, users will have an option to check all or uncheck all. After selecting file type, just click “OK”. The program will begin to search defined file. PS: Normal File Included is intended for device which has functional partition. Users have a chance to decide whether normal files need to be listed after search.
When found based on the signature, the files are listed into their own subfolder, e.g. JPEG, GIF etc.
Last, users can recover the files they want.
File Classification by Type and Date
In some cases, especially in Forensics, users need to classify recovered files by type or date. DCEXP of Version 6.0 allows users to do this.
Right click mouse on any directory, users can see the option of View File. There are four submenus: By File Type, By Created Date, By Accessed Date and By Modified Date. Users can choose any option and the program will output result in the folder called Searched.
Access to HD Doctor
For users who have the whole solution of SalvationDATA for data recovery, generally they need to use HD Doctor to fix firmware-level problem and then connect the drive to Data Compass to extract data. This procedure is inconvenient in some cases as users need to keep power on and remove data cable from HD Doctor and connect it to Data Compass. In DCEXP of version 6.0, such method is no longer needed as users have an option to access data through Data Compass directly without removing any cables.
First, users need to user HD Doctor to repair firmware problem and after that close the program of HD Doctor. Attention, only program need to be ended and HD Doctor is still on.
Second, connect only USB cable to Data Compass and launch the program “DCEXP.exe”. Attention: here users can close Read button on Data Compass panel as there’s no need to use DC Controller.
Third, click Open Disk—àAccess to HD Doctor—à HD Doctor for WD (here we take HD Doctor for WD as an example).
Then the program will open partition of that drive connected to HD Doctor and users can extract data.
Attention: as data is transferred through PCI cable in HD Doctor, it will take a long time to extract a big file.
Comments