Scanning and analysis of contents of a disk
When starting to analyse a new disk it is often very useful to get an idea of what is on the disk, and where is is located. The Disk Scan function in CnW will assist with this problem by giving a visual display of contents of the disk.
Forensically, this feature gives a very quick visual display of how the disk has been used and so shows areas that have been used, and an indication of data types.
To use this option does require the Forensic Features to be enabled. To do this with the demo program, please contact CnW to obtain a new demo password , info@cnwrecovery.com
To make analysis easier, different ‘layers’ of the disk may be viewed separately. As an example it is possible to display just blank sectors, sectors indicating file starts, or maybe ones of locations of known files. The functions work on any disk type even with totally corrupted file systems. It is also possible to zoom in in certain areas of the disk for very detailed display. By seeing areas of the disk that have been used, it is possible to isolate unallocated areas of the disk, and also see if the sectors are blank
The screen bitmap indicates the type of sector found on the disk and these may be selected from the option check boxes. When a sector is clicked on with the mouse, the status list on the left f the screen will give sector numbers and describe how the sectors have been detected.
The display has a limited number of status lines, and so each status line may represent more than a single sector. When this happens, the colour will be chosen for the most important description, this a file start line will be shown rather than a blank sector line. By changing the check boxes each layer can be seen separately
As the analysis is not dependent on reading the disk logically, all types of disk may be scanned. It will detect recognised system sectors and directory sectors from all known types of disk. For instance MFTs, and FAT directory entries.
When the mouse is clicked on the graphical area, the status box will show the hundred file start locations, and file type.
The function has been optimised for multi-core processors