The forensic report is part of the Forensic Options, controlled by the program licence.
The function of the report is to be the basis of any log or report listing actions and tests on the drive. It will report any disk errors, and other errors the standard logical recovery have not been possible. The best example would be when it has not been possible to resolve a full directory path, and a dummy directory entry has been created.
The report is part of the main log screen, and selected by the tab at the top of the box.
Log entries, from program Wizard
The wizard performs tests on the physical media, and the following status messsges, or errors will be detected. The results from the Verify Disk structure are stored in the log
The log will monitor all options that have selected as part the appropiate recovery screen.
NTFS - these will include
$MFT start cluster and start sector
FAT - these will include
Cluster 2 location
The forensic report will do basic analysis on system files. This will include $bitmap and $logfile
Fixup error in MFT - and MFT has self checking built in, an error was found
Cluster out of range - a cluster higher the length of the partition was requested
MFT entry not found at expected location - the specified locatioon is not an MFT
MFT entry not found at cluster 4 - when an MFT is not set by BIOS, some values are tested
MFT entry not found at cluster 0xc0000- when an MFT is not set by BIOS, some values are tested
Cluster 0xc0000 has been set as start of MFT - a 'guessed' value has been used
Cluster 4 has been set as start of MFT - a 'guessed' value has been used
MFT for xxx not a directory MFT - a parent directory location is invalid
FAT parent directory not fund for cluster : xxx - the parent directory was not found, dummy directory will be created. This is the directory that is pointed to by the '..' entry in the directory stub.
File truncated, found xxx expected yyy - the full file has been truncated, often due to a FAT entry indicating end of file.
Next cluster same as current cluster, incrementing value - this will cause the program to loop on single cluster, so the next sector will be selected automatically.