The disk scan function (forensic option only) will scan a disk, sector by sector and indicate where data has been stored.  There are several catagories of data it will detect, and can be selected by the user.

The types of sector detected are

• Blank sector - there is no data in this sector
• Bad sector, was unreadable
• Partition starts - this was a sector such as a partition sector, or BPB
• Directory files, eg a MFT entry, or FAT directory
• File start - has found a recognisable signature
• Text data.  The data is largely text
• Compressed data.  The data is largely compressed.  This could be for JPEGs, video files, ZIP files, and sometimes programs, .exe, .dll etc

When the check box is selected, or changed, the display will be updated.  This way the colour of each data type can be seen clearly

When the cursor is clicked on the chart, the left hand box is filled in with possible file start data.  In the example above it shows MPEG and INDX entries.  The number is the hex value for the sector analysed.