Advanced users and IT professionals may require inspecting raw disk structures before actual recovery occurs - to evaluate damage to the data and recovery chances. For these purposes Disk Editor (Hex Viewer) supplied as a separate application and is accessible from recovery panel. Launch it from the context menu for the object to be inspected (hard disk, volume, file data):
For FAT/FAT32 & NTFS volumes inspection of headers of file records is available, for example Disk Editor is launched and "NTFS MFT file record" template is applied for binary data automatically:
Active@ Disk Editor uses a simple, low-level disk viewer which displays information in binary and text modes at the same time. You can use this view to analyze the contents of data storage structure elements such as:
Template view shows parsed records of the most important areas on disk, allowing easily interpretation and editing.
When you navigate to a point of interest, a proper template is selected automatically. The following templates are supported: MBR, NTFS boot sector, FAT boot sector, FAT32 boot sector, exFAT boot sector, HFS+ Volume header, Ext2/Ext3 superblock, NTFS MFT file record, FAT directory entry, exFAT directory entry, LDM structures.
As you edit data in Hex, ASCII or Unicode pane or in Templates window, modified data is fully synchronized between views. After each modification a template view is recalculated giving you an up-to-date interpretation of data.
MFT file record template shows data in great detalization level using multiple levels. You can examine a standard header, all attributes and attribute data of the record. The attributes interpreted are: $STANDARD_INFORMATION, $ATTRIBUTE_LIST, $FILE_NAME, $OBJECT_ID, $SECURITY_DESCRIPTOR, $VOLUME_NAME, $VOLUME_INFORMATION, $DATA, $INDEX_ROOT, $INDEX_ALLOCATION, $BITMAP, $REPARSE_POINT, $EA_INFORMATION, $EA, $LOGGED_UTILITY_STREAM.
Some records like boot sectors have their copies. Templates view automatically detects records supporting copies and shows both main and copy values allowing to compare them. You can arbitrary set an offset of main record and its copy.
Individual template fields are colored in hexadecimal pane giving a quick overview of all data. As you travel along fields in Templates window, the current field is highlighted in Hex pane. Hover mouse over a colored field to get a tooltip with additional information.
exFAT boot sector as well as all types of exFAT directory entries are supported giving you a detailed information on different exFAT structures. Move template offset up/down feature allows easily navigate between records.
You don't need to guess what is the sector of root directory on FAT volume is or where is $MFT record on NTFS partition located. Simply use fast navigation points set up in the menu. When Disk Editor opens an object, the most important areas are detected and automatically added to the list. They include boot sectors, FAT tables, root directory, $MFT and $MFT Mirror and others.
It might be handy to fill an area on the disk with particular data. Besides simply zeroing an area by providing 00 as hexadecimal value you can specify any hexadecimal or text pattern for better flexibility.
Work with hexadecimal, ASCII or Unicode representation of data. Editing data in Unicode pane allows to enter extended characters directly while ASCII and Hexadecimal panes gives you control over individual bytes.
Properties window gives a concise overview of disk or partition opened in Disk Editor. If unwanted this information can be hidden to save screen space.
When analyzing large amounts of data don't get lost when navigating between different points. Easily bookmark locations by keyboard shortcuts and cycle through them. If you need even more flexibility, you can give any bookmark a name and navigate between them using a bookmark window.
As you move a cursor along, data under cursor is automatically interpreted and shown in Data Inspector in different formats. You can see them as one to four byte numbers as well as time and other useful structures.
This document is available in PDF format,
which requires Adobe® Acrobat® Reader
(Free download):
