The Data Extractor Portable is a specialized software product functioning in tandem with the PC-3000 Portable hardware-software product. It is intended for recovering data from SATA (Serial ATA) and PATA (IDE) HDD 3.5", 2.5", 1.8", USB HDD, SSHD (Solid State Hybrid Drive), etc. Together with the PC-3000 Portable it forms a professional mobile solution for your data recovery business.
- Works with all of the most popular file systems: FAT, exFAT, NTFS, EXT2/3/4, HFS+, UFS1/2, XFS, ReiserFS, VMFS
- VMDK (VMWare) images are supported
-
Data Extractor Portable has modes used in forensic investigations
If you install the Data Extractor Portable together with the PC-3000 Portable on a laptop, you will have a professional mobile data recovery system
The Data Extractor Portable can work with 1 SATA HDD or 1 PATA HDD. Drives can be connected to the PC-3000 Portable, motherboard ports (xSATA, xUSB etc) or represented as HDD images.
The PC-3000 Portable allows you to repair physically damaged HDD drives in technological mode. Data reading is provided in UDMA33 reading mode.
Using the Data Extractor Portable you can create full (sector-by-sector) or partial data copies from the damaged drive to a good one connected to the port of a desktop computer or laptop, motherboard or in image-files.
"Explorer" mode
Recovering data with the Data Extractor Portable
There are three types of HDD malfunctions: physically damaged HDD, logically damaged HDD and HDDs with a combination of physical and logical damage.
Physically damaged HDDs:
Physical damage in HDDs includes:
- damaged magnetic surfaces
- malfunctions of the magnetic head assembly (MHA)
- service information destruction
- translator malfunction (LBA to physical geometry)
- unstable reading caused by re-installation of MHA or disk pack
- data recovery after HOT-SWAP procedure.
Logically damaged HDDs:
Logically damaged HDDs are hard drives with damaged logical structures which prevents access to the user information via OS instruments.
This can be caused by:
- Damaged partition information (MBR, GPT, APS etc.)
- slight damage to file system metadata caused by HDD or OS failures
- deleted folders and files
- significant damages to data and metadata caused by formatting
- logical damage caused by viruses
Combination of physical and logical damage:
You may use the wide possibilities of the Data Extractor Portable product to handle various types of data recovery cases, including those that are connected with both physical and logical damage.
Data recovery from physically damaged HDDs
It is very important to read the maximum data volume in the shortest period of time as a damaged HDD can stop functioning at any time. The Data Extractor Portable has integrated functionality for logical analysis of file systems which allows for reading of only necessary data. This technology greatly reduces the volume of read data, the duty cycle of damaged HDDs and the time required for data recovery.
The Data Extractor Portable has extended functionality for HDD reading:
- HDD reading in technological mode
- reading by head map
- choosing the reading mode (UDMA 33, PIO 4/3/2/1/0)
- read forward and backward
- read ahead (cash function) disabling
- autorelocation disabling
- reading with hardware and software retries
- reading with ignoring ECC
- reading by used/unused sectors map
- power supply control
- software and hardware resets
The "Create virtual translator" option enables recovery of data from an HDD with a corrupted dynamic translator. File system metadata and user data are used in this mode.
Partition map
Data recovery from logically damaged HDDs
There are some special modes for recovering data from logically damaged HDDs:
- "Explorer" mode – to get access to the damaged partitions, folders and files
- "Raw recovery" mode – to recover data when file system structures are catastrophically damaged
- "Object map" mode – to work with fragmented structures (reading, copy creation etc)
- "Quick disk analysis" mode – to solve cases with damaged information about partitions
- "Partition data analysis" and other special modes for each file system – to recover data from specific damaged file system (including data deleted by users)
- Modes for viewing and editing metadata in various file systems
- Building maps of used/unused sectors, metadata and file system data
Raw recovery
Using the Data Extractor Portable for forensic purposes
The Data Extractor Portable has special modes used by forensic investigators:
- hash sum calculation for MD5 and SHA1
- exporting catalogs list and files into csv format
- building various maps: disk maps, used/unused sectors maps, file system metadata maps etc
- unlocking the HDD
- changing/resetting to factory value of MaxLBA HDD
- HDD mounting in "read-only" mode
- HDD data copy creation
SEE ALSO:
