Data Fragments

Many files are stored sequentially on a disk, but a number of files are actually fragmented.  When CnW recovers files it will actually log the location of each fragment.  Forensically this can help provide information of when a file has been overwritten, or by which file.

The information is stored in the log.  The frags column will show the number of fragments that the file is stored in.  When this number is double clicked, the display below is shown.

dir_run1

The display will indicate the start and length of the first 80 data runs of any file.  If a row is double clicked, the sector hex dump will be displayed.

The same information is actually included in any save of the log as a .csv file

Download the demo now to evaluate this feature

 

[CnW Recovery] [Downloads] [Purchase Now] [CnW Wizard] [User Manual] [Forensic DR] [Video recovery] [Forensic Tools] [NTFS Forensic] [FAT Forensic] [Unallocated] [Data carving] [Manual Carving] [Forensic CD] [DVD properties] [Overwritten] [Disk scan] [JPG Size] [Forensic Report] [Forensic Practice] [Forensic XML] [Keyword Search] [Search Disk] [File hashing] [MFT Parse] [Data Fragments] [E01 and Virtual] [What will it do?] [Product Details] [FAQ & Links] [Case Studies] [Technical Notes] [Updates] [Development] [Testimonials] [About us] [Site Map] [Contact Us]