UFS Explorer Technician
- Work with forensic images of various formats
- Configurable disk reading procedure
- Advanced mechanism for creating disk images
- Support of numerous storage technologies
- Integrated algorithms for disk decryption
- Automatic reconstruction of complex storages
- Versatile RAID Builder with an internal script handler
- Multiple features facilitating work with defective storages
- Variety of tools for efficient analysis and editing of raw data
- Extensive reporting options, including files integrity control
Overview
UFS Explorer Technician is a comprehensive software solution which is adapted for the use in highly challenging data recovery tasks and complies with the requirements of various technical specialists, like computer forensics investigators and data recovery engineers.
In addition to physical storage devices, like hard disk drives, USB sticks and memory cards, the software works with various disk images created with professional forensic instruments, like EnCase or FTK Imager, and regular disk imaging tools. The in-built decryption techniques allow opening volumes encrypted with BitLocker, LUKS, FileVault 2 and APFS right in the software, without deciphering them in the operating system. Complex RAID-based storages are supported by the program as well, including standard, nested, custom and specific layouts – Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID and ZFS RAID-Z. The utility is also capable of dealing with a whole range of file systems employed in Windows, Linux, macOS, BSD and other environments, providing immediate access to available files, along with diverse storage technologies – Windows Dynamic Disks, Storage Spaces and deduplication, Apple Software RAID, Core Storage and Time Machine, Linux mdadm and LVM with Thin Provisioning and others. Moreover, the application is able to recover data from various virtual machines, among which is VMware, Hyper-V, VirtualBox, QEMU, XEN, etc. Supplemented with extensive reporting functionality and a mechanism of file integrity control, the software doesn't change the content of the data carrier and can serve as a reliable tool for the retrieval of credible evidence.
Furthermore, UFS Explorer Technician is equipped with a broad variety of means for maximally efficient processing of defective and unstable storage devices. The application presents an advanced procedure for opening disks with control over reading errors and a possibility to immediately save the accessed data to a "sparse" image file. Other types of disk images can also be created with the help of an embedded imager, which offers a variety of reading parameters, including ones for handling defective areas. A map with defective blocks can be generated during imaging or through the conversion of used/free file system space to mask and utilized during other operations. On top of that, the process of imaging performed by compatible external systems, like DeepSpar DDI and MRT Express/Ultra, can be managed by the software and enhanced with the possibility to use a file system map or a map emulating bad blocks. The binary content of files and storages can be analyzed and modified directly in the program with a vast range of helpful tools.
Technical specifications
Windows: NTFS, FAT, FAT32, exFAT, ReFS/ReFS3;
macOS: HFS+, APFS;
Linux: Ext2, Ext3, Ext4, XFS, Extended format XFS, JFS, ReiserFS, UFS, UFS2, Adaptec UFS, big-endian UFS, Btrfs;
BSD/Solaris: ZFS volumes;
VMware: VMFS, VMFS6.
macOS: HFS;
Novell: NWFS, NSS, NSS64;
AIX: Legacy JFS1, JFS2; Xinous OpenServer: EAFS, HTFS, DTFS;
Veritas Storage Foundation, HP-UX, etc.: VxFS4, VxFS6, VxFS7;
Urive: NxFS.
Logical Disk Manager, Storage Spaces, Microsoft volume deduplication, Apple Core Storage, LVM with thin provisioning, mdadm
Providing a partition table, information about Spans and Stripes of LVM2, AIX LVM, HP-UX LVM, Apple Software RAID
Giving a partition structure for MBR, Apple Partition Map, BSD/Adaptec/Solaris/Unix Slice Map, GPT, Novel, Intel Matrix
Drobo volumes, HP EVA, HP LeftHand, Symphony SAN
Hexadecimal viewer for storages, partitions, files, file fragments
Hexadecimal editor for disks and partitions
Field highlighting
Data interpreter
Parity calculator
Storage content comparison
Bitwise "exclusive OR" (XOR) function
Parallel search
Data allocation tracing through reverse address translation
View of file fragments with virtual offsets and sizes
Indication of used file system space
Pausing the scan
Previewing intermediate scan results
Saving scan results for further work
Full-range storage scan for all-at-once data recovery
Visualization of the scanning process
Five options for handling the existing file system
Detecting lost partitions
Automated partition aligning
Defining partitions manually
Auto-span tool
Interactive HTML report
Basic list of folders and files (HTML, CSV, XML)
Extended report on files and folders with the possibility of file integrity control (hash value, metadata test)
Report on file fragments
Recoverable data size with metadata test
Software events log
Software activation options
Software-based Access Key
A Sentinel SL electronic key based on the "fingerprint" of the user's computer which should be installed and stored within the system.
- Doesn't require physical shipment
Hardware-based Access Key
A Sentinel HL key on a USB-device that enables running the software when physically connected to the computer.
- Can be transferred between different machines
The details related to the usage of different types of Access Keys along with other licensing terms and conditions are available in the End-User License Agreement.
Key features
When to use UFS Explorer Technician
The utility effectively works with various linear storage devices, including internal as well as external hard disk drives, USB flash drives, memory cards and many others, thus serving as an essential data recovery tool for handling most typical cases of data loss, like accidental deletion of files, storage formatting, malware attack, hardware or software malfunction, etc.
UFS Explorer Technician is an efficient solution for restoring data from RAID of different complexity, both software and hardware, and various RAID-based storages, like DAS, NAS and SAN. Moreover, the software makes it possible to perform data recovery from systems that apply specific RAID configurations, like Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID, ZFS RAID-Z, Dell EqualLogic and HP MSA with diagonal XOR.
The software is enhanced with wide support of modern storage technologies employed in different environments. It allows processing composite volumes, including Apple Core Storage, LVM with thin provisioning, MS Storage Spaces and Dynamic Disks, deduplicated NTFS and ReFS partitions, SCSI/SAS-drives with non-standard sector sizes, etc. which significantly expands the list of target devices it can be applied to.
The application is able to decrypt disk volumes for data recovery and data access purposes (if the encryption key is known). The list of supported methods includes LUKS, FileVault 2, BitLocker, encryption of Apple APFS volumes and eCryptFS.
The program is able to generate an extended report on the data which may be particularly beneficial for forensic experts. Such a report contains the list of available files, their properties, checksums calculated for them using the chosen hashing algorithm together with the information about the scanned storage, the date of the scan and the time when the report was created.
The application gives the possibility to recover data from storages that have damaged sectors or other hardware issues with maximum efficiency. Not only it offers highly configurable disk reading and imaging procedures, but also generates a map of bad blocks during the imaging process. In addition, virtual bad blocks can be defined dynamically on disk images by recognizing a given pattern or by reading bad sectors maps created by other compatible solutions. The software also allows converting the used or free file system space to a mask with emulation of defects and use it for imaging/scanning. Bitmap-based imaging via DeepSpar DDI is supported by the program as well.
UFS Explorer Technician effectively deals with disk images and virtual disks created by major virtualization software, like VMware, Microsoft Hyper-V, VirtualBox, QEMU, XEN, etc. and successfully copes with data recovery from such storages as though they were ordinary physical devices.
The software is capable of imitating work of virtualization software and consequently provides access and restores files from multi-level virtual storages with no additional operations required. For example, the user can scan a virtual disk stored inside another virtual disk and promptly retrieve files that were lost or deleted from it.
A set of tools integrated into the software allow effectively solving practically any case of logical data loss, including the most severe ones. The program will either simply read file system metadata or conduct its detailed analysis and predict the allocation of files based on the file system specifics, allocation of other files or file content analysis to produce the best possible data recovery result.