Articles

Identification of different storages and technologies for further processing in UFS Explorer

The demands for greater security, faster performance and higher cost-efficiency encourage the expanding diversity of technologies that complement traditional storage devices. Besides changing the way how we configure and manage the storage, the implementation of modern storage options often impact the approach taken for addressing data loss issues.

As a matter of fact, to enable a successful recovery of lost information, most of the storage technologies need to be treated differently. Yet, it is not always evident which of them is deployed on a particular device, especially in the context of data recovery services or digital forensics. UFS Explorer makes it easier to work with various storage technologies by providing useful hints. They may be of much help for understanding the crux of the case you are dealing with and what steps are to be performed next.

The following materials describe how different storages are identified in the program. In addition, some important hints are provided as to the state of the processed device or logical volume.

Content:

Icons for physical or virtual storage devices

Different types of icons are used by the software to denote stand-alone physical or virtual storages and reconstructed complex storage systems:

  • Linear storages

    • Mechanical hard disk drive

      This icon shows up for various types of the traditional spinning hard disk drives, both connected internally and as portable USB storages. It is also used as a default indicator for all simple physical digital media.

    • Solid-state drive

      This label signifies a solid-state device (SSD) that stores data on flash-based memory, instead of spinning platters used by mechanical hard disks.

    • USB flash drive

      This icon is used in conjunction with compact flash drives that are connected to the computer externally via a USB port, also referred to thumb drives or USB sticks.

    • Direct ATA access

      This icon appears when operations with the drive are performed using a direct ATA command set instead of the "standard system procedure" that is likely to cause problems for defective drives. This mode is supported under Windows for SATA and PATA drives.

    • Direct SCSI access

      This label is used when operations with the drive are performed using a direct SCSI command set instead of the "standard system procedure". This mode is supported under Windows and Linux for most types of connection.

    • Non-accessible drive

      The exclamation mark may appear for drives the access to which is prevented by a certain external mechanism, for example, by System Integrity Protection (SIP) in macOS.

    • Disk image or virtual disk

      This icon is displayed for an opened file representing a virtual data carrier. Such a file may contain a full or partial copy of a storage device (disk image) or be used a substitute for a physical drive by a virtual machine (virtual disk).

    • VMDK virtual disk

      This label is associated with a virtual machine disk file of the *.vmdk format used by VMware and other virtualization products.

    • VHD(X) virtual disk

      This icon shows up for an opened virtual hard disk of the*.vhd and *.vhdx formatas utilized by Hyper-V and other virtual machines.

    • Transformed storage

      This type of icon is assigned to a disk after its decryption with the help of the deciphering techniques embedded into UFS Explorer (for BitLocker, LUKS, FileVault 2, etc.).

    • Network drive

      This label is shown for drives that were connected over the network via iSCSI or via the Agent in the Network RAID edition of UFS Explorer.

    • DeepSpar drive via network

      This icon is displayed when a defective drive is connected to a computer with the help of the DeepSpar Disk Imager device. Such drives can be operated by the software via LAN.

    • DeepSpar drive clone

      The label is used for the target drive which is connected directly to the computer and contains the data copied from the source disk via DeepSpar Disk Imager and the map of defective blocks. The same icon appears for drive clones created via DeepSpar USB Stabilizer.

    • Storage with a map

      The label corresponds to a storage with an enabled map of its block states that can be used for defects recognition.

    • Disk imaging task

      This icon can be displayed in association with a disk image file created in the on-demand (imaging task) mode.

    • MRT Data Explorer

      This sign appears in UFS Explorer for a drive with an applied MRT Task file that was created by MRT Data Explorer. Such drives can be processed in the program by means of the MRT hardware/software solution.

  • RAID-based systems

    • Complex storage

      This label appears for RAID and other RAID-based complex storages assembled by the software in a virtual mode.

      Additional indications:

    • Degraded complex storage

      The icon is applied to storage arrays assembled by software and shows up when its component (or several components, depending on the configuration) has failed or hasn’t been attached properly to the computer. The complex storage can still be processed, but one should be aware that it is functioning in a degraded mode.

Icons for logical volumes

There are two kinds of icons employed by UFS Explorer for logical volumes: ones that describe their state or accessibility and ones that refer to specific storage technologies implemented on them:

  • State of the available file system

    • Accessible

      The green icon means that the available file system can be accessed and that the boot records as well as file entries are found for this volume.

    • Needs attention

      The yellow icon signifies that there are certain issues with the volume, and it may not be accessed properly. Also, this color may denote an empty partition or one with a proprietary file system, such as DHFS on CCTV appliances.

    • Parsing error

      The red icon signals that there are serious problems with access to the volume content, for example, in case of a corrupted root directory or damaged file system.

    • Not recognized

      The gray icon states that the file system applied on the volume cannot be identified or is not supported by the software.

    • Deleted

      The red "X" icon indicates a volume that wasn’t found by its original metadata. However, a copy of metadata could be located via a search through a set of "standard" positions on the storage and used to restore this volume.

  • Volumes with specific technologies

    • Component of a complex storage

      This label is used for partitions that have been identified as parts of a RAID system or JBOD.

      Additional indications:

      • Span component partition – a volume belonging to JBOD;

      • Software Mirror partition – a mirrored volume (part of RAID 1);

      • Software RAID* partition – a constituent of RAID.

    • Swap partition

      This icon indicates a service partition that is used in a Linux-based system as overflow space for the RAM.

    • SSD cache meta-partition

      This label denotes a service partition from QNAP or Synology that is placed on SSD and contains the most frequently requested data blocks required for correct data extraction from appliances with enabled SSD cache.

    • Encrypted volume

      The padlock icon means that the volume is encrypted and has to be unblocked in the software using the respective decryption technique.

      Additional indications:

      • APFS partition – a volume encrypted using the standard means of the APFS file system (only in combination with the padlock icon);

      • BitLocker partition – a partition encrypted with the BitLocker security feature of Windows;

      • FAT* partition/ ExFAT partition – a partition on a removable drive that was encrypted with BitLocker To Go (only in combination with the padlock icon);

      • LUKS partition – a partition encrypted by the Linux LUKS technology.

    • Partially encrypted BitLocker partition

      The gray padlock icon denotes a BitLocker partition whose encryption wasn’t accomplished in full due to interruption of the process or other issues.

    • Decrypted APFS

      A green opened padlock appears for encrypted APFS after such volumes have been deciphered in the software.

    • Deduplicated volume

      NTFS or ReFS volumes are displayed with this icon when the Data Deduplication feature is enabled for them.

    • Contains metadata of a composite volume

      This icon can be used with a partition that serves as a crucial element for work with a composite virtual volume.

      Additional indications:

      • LVM-meta partition – a partition that contains LVM Metadata for thinly-provisioned volumes of Linux LVM;

      • Apple Core Storage partition – a Data Partition located on the SSD component of Apple Fusion Drive or a Data Partition on a storage encrypted with Apple FileVault 2;

      • MS Storage Space partition – a constituent of a Storage Space virtual volume of Microsoft.

    • WD My Cloud volume

      A cloud icon is displayed for a partition that keeps user data on WD My Cloud Home and WD My Cloud Home Duo models of NAS.

For more detailed information as to the support of the given technologies by different UFS Explorer products and for links to the respective data recovery tutorials, please refer to the storage technologies page.

Last update: August 16, 2022