Introduction
- Disk Investigator -

Copyright  Kevin Solway 2002

– Discover all that is hidden on your hard disk –

For all of FAT12, FAT16, FAT32, and NTFS file systems
(Win95, Win98,  WinME, WinNT, Win2000, WinXP).

Introduction

Disk Investigator helps you to discover all that is hidden on your computer hard disk. It can also help you to recover lost data.

·  Locate sensitive data with the search viewing functions

·  Display the true drive contents by bypassing the operating system and directly reading the raw drive sectors

·  Undelete previously deleted files.

·  View raw directories, files, clusters, and system sectors

·  View low level BIOS parameter block attributes

·  View files through external applications

·  Search files and raw clusters for content

·  Verify the effectiveness of file and disk wiping programs

Software License

Disk Investigator is copyrighted software.

Disclaimer

This software is provided as is and without warranty. The author assumes no liability for damages, either direct or consequential, which may result from the use of this product.

Contact

Disk Investigator Web Page: http://www.theabsolute.net/sware/dskinv.html

Clean Disk Security: http://www.theabsolute.net/sware/clndisk.html

Solway’s Software Page: http://www.theabsolute.net/sware/

E-mail:  software@theabsolute.net


Viewing disk contents directly

There are two disk viewing modes modes, which you can switch between using the radio buttons at the top left of the Disk Investigator window:

1. Disk mode.

Here you can view the raw contents of disk on a sector-by-sector basis. Use the horizontal slider at the bottom to view different parts of the disk. You can also enter the sector number directly.

This mode can be used for viewing both the used space of the disk as well as the free space (which may contain recoverable data).

2. Directory mode.

In this mode you can view the disk contents via the directory structure, which enables you to view the raw contents of any file on the disk.

This mode cannot be used for viewing the free space of the disk.

Names of deleted files are visible to you (in red). Note: Names of deleted files are not visible on NTFS volumes. (This will have to wait for a later release of this software)

To fully erase the remains of previously deleted files, use a program like Clean Disk Security.


How to clean your disk

Now that you have seen what can be discovered on your disk, you might want to see what you can do about cleaning it up.

Your disk can be cleaned with a program like Clean Disk Security. There are other programs which do a similar job, but I mention this one for two reasons:

1.	It does everything you need.

2.	 I wrote it, so I know what it does.

Clean Disk Security can securely wipe clean all of the following:

-	Standard drive free space

-	File slack space (unused space in cluster tips)

-	Names of deleted files and folders

-	Files in the recycle bin

-	Recent files list and URL lists

-	Files in the Windows Temp folder

-	Internet browser cache files

-	Internet history records

-	Internet cookies

-	Windows’ swap file

-	Any files or folders that you specify

Download Clean Disk Security: http://www.theabsolute.net/sware/clndisk.html


Contact Information

Disk Investigator Web Page: http://www.theabsolute.net/sware/dskinv.html

Clean Disk Security: http://www.theabsolute.net/sware/clndisk.html

Solway’s Software Page: http://www.theabsolute.net/sware/

E-mail:  software@theabsolute.net


Searching for Data

This function is available when Disk Investigator is running in “Disk” view mode.

Use this function to search for data on the selected disk. This function will search all the used and unused space on the disk.  (Note that data can be found on the “unused” part of the disk.”)

To cut short a search before it has completed the whole disk, click on the search button (which displays “Stop” while a search is in progress).

Match case:  Check this option to perform a case-sensitive search.  For example, if a file contains the string “Account”, and you enter a search string of “account”, the search will fail if this option is checked because the uppercase “A” does not match the lowercase “a”.

Hex bytes: Check this option to search for binary data instead of a text string.  Enter an even number of hexadecimal digits (0123456789ABCDEF) to form a whole number of bytes.  You may insert spaces between bytes for readability.

    For example, both the following hexadecimal search entries will work:

                                      14AB4FF0

                                              or,

                                      14 AB 4F F0


Hexadecimal Converter

Use this tool (found in the help menu) to convert between hexadecimal and decimal integers.


Undeleting files automatically

Use this function to try and automatically recover previously deleted files (ie, those colored red on FAT file systems).

Preferably select a different drive as a destination for the recovered files, which will eliminate the risk that data yet to be recovered is overwritten by recovered files.

The undelete function in this program is a rudimentary one that is unable to undelete many of the files that can be undeleted by specialist programs.

See also: Saving a collection of Clusters


Saving a collection of Clusters

To recover data cluster-by-cluster you need to open the cluster view dialog.  The cluster view dialog appears either when you double-click on a file when in directory view mode, or when you click on the “View” button, or when you select to view an item found in a search. At the bottom of the cluster view dialog you will see a “Memory file (saved clusters)” group box. Here you can add cluster data, one cluster at a time, to a file stored in memory. When you have added all the clusters you want, you can write the file out to disk.

This function is especially useful when trying to reconstruct a deleted file from the raw cluster data. You would add all the clusters of the deleted file to the memory file,  in the correct order, and then write the file out to disk.

Ideally you should write the file out to a different disk than the one you are recovering data from, so as not to overwrite data you might subsequently want to recover.

See also: Undeleting files automatically