Inspect file headers and raw sectors

Inspect file headers and disk data (raw sectors) with integrated Disk Editor (Hex Viewer)

Advanced users and IT professionals may require inspecting raw disk structures before actual recovery occurs - to evaluate damage to the data and recovery chances. For these purposes Disk Editor (Hex Viewer) supplied as a separate application and is accessible from recovery panel. Launch it from the context menu for the object to be inspected (hard disk, volume, file data):

Inspect file headers and disk data

For FAT/FAT32 & NTFS volumes inspection of headers of file records is available, for example Disk Editor is launched and "NTFS MFT file record" template is applied for binary data automatically:

Inspect file headers and disk data for FAT/FAT32 & NTFS

Active@ Disk Editor basics

Active@ Disk Editor uses a simple, low-level disk viewer which displays information in binary and text modes at the same time. You can use this view to analyze the contents of data storage structure elements such as:

  • Hard disk drives
  • SSD & USB Disks
  • Partitions & Volumes
  • Files
Active@ Disk Editor screenshot

The Main Features:

  • Enhanced template view
  • Detailed MFT record information
  • Side-by-side Compare and Edit
  • Fields coloring with data in tooltips
  • Extensive exFAT support
  • Fast navigation points
  • Filling selection with a pattern
  • Unicode support
  • Quick Disk Info
  • Bookmarks
  • Data Inspector

Enhanced template view

Template view shows parsed records of the most important areas on disk, allowing easily interpretation and editing.

When you navigate to a point of interest, a proper template is selected automatically. The following templates are supported: MBR, NTFS boot sector, FAT boot sector, FAT32 boot sector, exFAT boot sector, HFS+ Volume header, Ext2/Ext3 superblock, NTFS MFT file record, FAT directory entry, exFAT directory entry, LDM structures.

As you edit data in Hex, ASCII or Unicode pane or in Templates window, modified data is fully synchronized between views. After each modification a template view is recalculated giving you an up-to-date interpretation of data.

Enhanced template view

Detailed MFT record information

MFT file record template shows data in great detalization level using multiple levels. You can examine a standard header, all attributes and attribute data of the record. The attributes interpreted are: $STANDARD_INFORMATION, $ATTRIBUTE_LIST, $FILE_NAME, $OBJECT_ID, $SECURITY_DESCRIPTOR, $VOLUME_NAME, $VOLUME_INFORMATION, $DATA, $INDEX_ROOT, $INDEX_ALLOCATION, $BITMAP, $REPARSE_POINT, $EA_INFORMATION, $EA, $LOGGED_UTILITY_STREAM.

Detailed MFT record information

Side-by-side Compare and Edit

Some records like boot sectors have their copies. Templates view automatically detects records supporting copies and shows both main and copy values allowing to compare them. You can arbitrary set an offset of main record and its copy.

Side-by-side Compare and Edit

Fields coloring with data in tooltips

Individual template fields are colored in hexadecimal pane giving a quick overview of all data. As you travel along fields in Templates window, the current field is highlighted in Hex pane. Hover mouse over a colored field to get a tooltip with additional information.

Fields coloring with data in tooltips

Extensive exFAT support

exFAT boot sector as well as all types of exFAT directory entries are supported giving you a detailed information on different exFAT structures. Move template offset up/down feature allows easily navigate between records.

Extensive exFAT support

Fast navigation points

You don't need to guess what is the sector of root directory on FAT volume is or where is $MFT record on NTFS partition located. Simply use fast navigation points set up in the menu. When Disk Editor opens an object, the most important areas are detected and automatically added to the list. They include boot sectors, FAT tables, root directory, $MFT and $MFT Mirror and others.

Fast navigation points

Filling selection with a pattern

It might be handy to fill an area on the disk with particular data. Besides simply zeroing an area by providing 00 as hexadecimal value you can specify any hexadecimal or text pattern for better flexibility.

Filling selection with a pattern

Unicode support

Work with hexadecimal, ASCII or Unicode representation of data. Editing data in Unicode pane allows to enter extended characters directly while ASCII and Hexadecimal panes gives you control over individual bytes.

UNERASER software: Unicode support

Quick Disk Info

Properties window gives a concise overview of disk or partition opened in Disk Editor. If unwanted this information can be hidden to save screen space.

Undelete files: Quick Disk Info

Bookmarks

When analyzing large amounts of data don't get lost when navigating between different points. Easily bookmark locations by keyboard shortcuts and cycle through them. If you need even more flexibility, you can give any bookmark a name and navigate between them using a bookmark window.

Undelete files: Active@ Hex Editor - Bookmarks

Data Inspector

As you move a cursor along, data under cursor is automatically interpreted and shown in Data Inspector in different formats. You can see them as one to four byte numbers as well as time and other useful structures.

Undelete files: Active@ Hex Editor - Data Inspector
 

sales@lsoft.net

+1 (877) 477-3553,
+1 (905) 812-8434

LSoft Technologies Inc.
2550 Argentia Road, Suite 218
Mississauga, Ontario
L5N 5R1
Canada

© 2016 LSoft Technologies Inc.