1. Main ►
  2. Knowledge Base ►
  3. Identification of storage technologies

Identification of different storages and technologies for further processing in UFS Explorer

icons used to denote different storage types and technologies in ufs explorer software

The demands for greater security, faster performance and higher cost-efficiency encourage the expanding diversity of technologies that complement traditional storage devices. Besides changing the way how we configure and manage the storage, the implementation of modern storage options often impact the approach taken for addressing data loss issues.

As a matter of fact, to enable a successful recovery of lost information, most of the storage technologies need to be treated differently. Yet, it is not always evident which of them is deployed on a particular device, especially in the context of data recovery services or digital forensics. UFS Explorer makes it easier to work with various storage technologies by providing useful hints. They may be of much help for understanding the crux of the case you are dealing with and what steps are to be performed next.

The following materials describe how different storages are identified in the program. In addition, some important hints are provided as to the state of the processed device or logical volume.

Content:

Icons for physical or virtual storage devices

Different types of icons are used by the software to denote stand-alone physical or virtual storages and reconstructed complex storage systems:

  • Linear storages

    • icons Mechanical hard disk drive

      This icon shows up for various types of the traditional spinning hard disk drives, both connected internally and as portable USB storages. It is also used as a default indicator for all simple physical digital media.

    • icons Solid-state drive

      This label signifies a solid-state device (SSD) that stores data on flash-based memory, instead of spinning platters used by mechanical hard disks.

    • icons USB flash drive

      This icon is used in conjunction with compact flash drives that are connected to the computer externally via a USB port, also referred to thumb drives or USB sticks.

    • icons Direct ATA access

      This icon appears when operations with the drive are performed using a direct ATA command set instead of the "standard system procedure" that is likely to cause problems for defective drives. This mode is supported under Windows for SATA and PATA drives.

    • icons Direct SCSI access

      This label is used when operations with the drive are performed using a direct SCSI command set instead of the "standard system procedure". This mode is supported under Windows and Linux for most types of connection.

    • icons Non-accessible drive

      The exclamation mark may appear for drives the access to which is prevented by a certain external mechanism, for example, by System Integrity Protection (SIP) in macOS.

    • icons Disk image or virtual disk

      This icon is displayed for an opened file representing a virtual data carrier. Such a file may contain a full or partial copy of a storage device (disk image) or be used a substitute for a physical drive by a virtual machine (virtual disk).

    • icons VMDK virtual disk

      This label is associated with a virtual machine disk file of the *.vmdk format used by VMware and other virtualization products.

    • icons VHD(X) virtual disk

      This icon shows up for an opened virtual hard disk of the*.vhd and *.vhdx formats utilized by Hyper-V and other virtual machines.

    • icons Transformed storage

      This type of icon is assigned to a disk after its decryption with the help of the deciphering techniques embedded into UFS Explorer (for BitLocker, LUKS, FileVault 2, etc.).

    • icons Network drive

      This label is shown for drives that were connected over the network via iSCSI or via the Agent in the Network RAID edition of UFS Explorer.

    • icons DeepSpar drive via network

      This icon is displayed when a defective drive is connected to a computer with the help of the DeepSpar Disk Imager device. Such drives can be operated by the software via LAN.

    • icons DeepSpar drive clone

      The label is used for the target drive which is connected directly to the computer and contains the data copied from the source disk via DeepSpar Disk Imager and the map of defective blocks. The same icon appears for drive clones created via DeepSpar USB Stabilizer.

    • icons Storage with a map

      The label corresponds to a storage with an enabled map of its block states that can be used for defects recognition.

    • icons Disk imaging task

      This icon can be displayed in association with a disk image file created in the on-demand (imaging task) mode.

    • icons MRT Data Explorer

      This sign appears in UFS Explorer for a drive with an applied MRT Task file that was created by MRT Data Explorer. Such drives can be processed in the program by means of the MRT hardware/software solution.

  • RAID-based systems

    • icons Complex storage

      This label appears for RAID and other RAID-based complex storages assembled by the software in a virtual mode.

      Additional indications:

    • icons Degraded complex storage

      The icon is applied to storage arrays assembled by software and shows up when its component (or several components, depending on the configuration) has failed or hasn’t been attached properly to the computer. The complex storage can still be processed, but one should be aware that it is functioning in a degraded mode.

Icons for logical volumes

There are two kinds of icons employed by UFS Explorer for logical volumes: ones that describe their state or accessibility and ones that refer to specific storage technologies implemented on them:

  • State of the available file system

    • icons Accessible

      The green icon means that the available file system can be accessed and that the boot records as well as file entries are found for this volume.

    • icons Needs attention

      The yellow icon signifies that there are certain issues with the volume, and it may not be accessed properly. Also, this color may denote an empty partition or one with a proprietary file system, such as DHFS on CCTV appliances.

    • icons Parsing error

      The red icon signals that there are serious problems with access to the volume content, for example, in case of a corrupted root directory or damaged file system.

    • icons Not recognized

      The gray icon states that the file system applied on the volume cannot be identified or is not supported by the software.

    • icons Deleted

      The red "X" icon indicates a volume that wasn’t found by its original metadata. However, a copy of metadata could be located via a search through a set of "standard" positions on the storage and used to restore this volume.

  • Volumes with specific technologies

    • icons Component of a complex storage

      This label is used for partitions that have been identified as parts of a RAID system or JBOD.

      Additional indications:

      • Span component partition – a volume belonging to JBOD;

      • Software Mirror partition – a mirrored volume (part of RAID 1);

      • Software RAID* partition – a constituent of RAID.

    • icons Swap partition

      This icon indicates a service partition that is used in a Linux-based system as overflow space for the RAM.

    • icons SSD cache meta-partition

      This label denotes a service partition from QNAP, Synology or Drobo that is placed on an SSD and contains the most frequently requested data blocks required for correct data extraction from appliances with enabled SSD cache/mSATA cache.

    • icons Encrypted volume

      The padlock icon means that the volume is encrypted and has to be unblocked in the software using the respective decryption technique.

      Additional indications:

      • APFS partition – a volume encrypted using the standard means of the APFS file system (only in combination with the padlock icon);

      • BitLocker partition – a partition encrypted with the BitLocker security feature of Windows;

      • FAT* partition/ ExFAT partition – a partition on a removable drive that was encrypted with BitLocker To Go (only in combination with the padlock icon);

      • LUKS partition – a partition encrypted by the Linux LUKS technology.

    • icons Partially encrypted BitLocker partition

      The gray padlock icon denotes a BitLocker partition whose encryption wasn’t accomplished in full due to interruption of the process or other issues.

    • icons Decrypted APFS

      A green opened padlock appears for encrypted APFS after such volumes have been deciphered in the software.

    • icons Deduplicated volume

      NTFS or ReFS volumes are displayed with this icon when the Data Deduplication feature is enabled for them.

    • icons Contains metadata of a composite volume

      This icon can be used with a partition that serves as a crucial element for work with a composite virtual volume.

      Additional indications:

      • LVM-meta partition – a partition that contains LVM Metadata for thinly-provisioned volumes of Linux LVM;

      • Apple Core Storage partition – a Data Partition located on the SSD component of Apple Fusion Drive or a Data Partition on a storage encrypted with Apple FileVault 2;

      • MS Storage Space partition – a constituent of a Storage Space virtual volume of Microsoft;

      • Intel Cache partition – a partition available on the Optane part of the Intel Optane Memory system that is used for caching of the most frequently accessed data.

    • icons WD My Cloud volume

      A cloud icon is displayed for a partition that keeps user data on WD My Cloud Home and WD My Cloud Home Duo models of NAS.

For more detailed information as to the support of the given technologies by different UFS Explorer products and for links to the respective data recovery tutorials, please refer to the storage technologies page.

Last update: January 09, 2024

If you liked this article, you can share it on social media: