The Data Extractor Express is a specialized software product functioning in tandem with the PC-3000 Express hardware-software product. It is intended for recovering data from SATA (Serial ATA) and ATA (IDE) HDDs 3.5″, 2.5″, 1.8″, 1.0″, USB HDD, SSHD (Solid State Hybrid Drive) etc. Together with the PC-3000 Express hardware-software it forms the most powerful and efficient professional solution for your data recovery business.
- Works with all of the most popular file systems: FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS
- VMDK (VMWare) images are supported
- The Data Extractor Express has modes used in forensic investigations
The Data Extractor Express is capable of working with 4 HDD drives simultaneously. Drives can be connected to PC-3000 Express ports (2xSATA, 2xSATA/PATA), motherboard ports (xSATA, xUSB etc) or represented as HDD images.
The PC-3000 Express allows you to repair physically damaged HDD drives in factory mode. SATA drives use UDMA133 reading mode while PATA drives use UDMA100 reading mode.
Using the Data Extractor Express you can create full (sector-by-sector) or partial data copies from the damaged drive to a good one connected to the port of the PC-3000 Express board, the motherboard or in image-files.
Recovering data with the Data Extractor Express
There are three types of HDD malfunctions: physically damaged HDD, logically damaged HDD and HDDs with a combination of physical and logical damage
Physically damaged HDDs:
Physical damage in HDDs includes:
- damaged magnetic surfaces
- malfunctions of the magnetic head assembly (MHA)
- service information destruction
- translator malfunction (LBA to physical geometry)
- unstable reading caused by re-installation of MHA or disk pack
- data recovery after HOT-SWAP procedure.
Logically damaged HDDs:
Logically damaged HDDs are hard drives with damaged logical structures which prevents access to the user information via OS instruments.
This can be caused by:
- Damaged partition information (MBR, GPT, APS etc.)
- slight damages to file system metadata caused by HDD or OS failures
- deleted folders and files
- significant damage to data and metadata caused by formatting
- logical damage caused by viruses
Combination of physical and logical damage:
You may use the wide possibilities of the Data Extractor Express product to handle various types of data recovery cases, including those that are connected with both physical and logical damage.
Data recovery from physically damaged HDDs
It is very important to read the maximum data volume in the shortest period of time as a damaged HDD can stop functioning at any time. The Data Extractor Express has integrated functionality for logical analysis of file systems which allows for reading of only necessary data. This technology greatly reduces the volume of read data, the duty cycle of damaged HDDs and the time required for data recovery.
The Data Extractor Express has extended functionality for HDD reading:
- HDD reading in factory mode
- reading by head map
- choosing the reading mode (UDMA 133/100/66/33, PIO 4/3/2/1/0)
- read forward and backward
- read ahead (cash function) disabling
- autorelocation disabling
- reading with hardware and software retries
- reading with ignoring ECC
- reading by used/unused sectors map
- power supply control
- software and hardware resets
The "Create virtual translator" option enables recovery of data from an HDD with a corrupted dynamic translator. File system metadata and user data are used in this mode.
Data recovery from logically damaged HDDs
There are some special modes for recovering data from logically damaged HDDs:
- "Explorer" mode – to get access to the damaged partitions, folders and files
- "Raw recovery" mode – to recover data when file system structures are catastrophically damaged
- "Object map" mode – to work with fragmented structures (reading, copy creation etc)
- "Quick disk analysis" mode – to solve cases with damaged information about partitions
- "Partition data analysis" and other special modes for each file system – to recover data from specific damaged file system (including data deleted by users)
- Modes for viewing and editing metadata in various file systems
- Building maps of used/unused sectors, metadata and file system data
Using the Data Extractor Express for forensic purposes
The Data Extractor Express has special modes used by forensic investigators:
- hash sum calculation for MD5 and SHA1
- exporting catalogs list and files into csv format
- building various maps: disk maps, used/unused sectors maps, file system metadata maps etc
- unlocking the HDD
- changing/resetting to factory value of MaxLBA HDD
- HDD mounting in “read-only” mode
- HDD data copy creation and reading to several recipients
SEE ALSO:
