The normative procedure of evidence collection is physically isolating the computer when first time of touching it. Then the forensic experts create the imaging files from the original drive in order to analyze the copies to avoid any influence to raw materials.
In order to analyze the data found on the hard drive, they used a variety of techniques and data recovery software to find any hidden or recently deleted files and folders. The types of evidence that can be obtained through data recovery software include documents, videos, photos, messages, audio, and even Internet search history of criminal suspects. One of the basic techniques used by computer forensic investigators is to scan and identify and delete files and folders that occupy the computer. Then, they will try to recover the data in these deleted files and often find valuable data that can help file a lawsuit against the suspect.
Various File System
Windows/MacOS/Linux
Various Storage Mediums
PC, laptop, USB, SD card, CF card, TF card, Memory Stick, voice recorder, web server, IPC, surveillance recorder and diverse virtual storage file, as well as hexadecimal view.
Unconscious Data Loss Again
The inappropriate operation to the targeted disk since unknown its status might cause secondary damage and more data loss.
Data Recovery System
DRS (Data Recovery System) is the next generation intelligent all-in-one forensic data recovery tool which can help you acquire and recover data from both good and damaged storage media like HDD simply and easily. Having integrated with main functions as disk diagnostics, disk imaging, file recovery, file carving, firmware recovery, reporting, write protection and hash calculation, more functional features as fragment recovery, RAIDx automatic reallocation, break-point recovery, USB3.0 support have been included in DRS as well. Especially for the work-flow of digital forensics, without external write blocker, read-only port has been embedded in DRS to ensure that data has not been tampered. Besides, DRS can generate and output detailed reports so that the investigation process can be clearly documented.
FILE RECOVERY & FILE CARVING
Fully support systems in NTFS, FAT16/32, exFAT, EXT2/3/4, HFS and HFS+, etc.
Support PC, laptop, USB, SD card, CF card, TF card, Memory Stick, voice recorder, web server, IPC, surveillance recorder and diverse virtual storage file, as well as hexadecimal view. The supported format includes DD image(as well as mobile phone image), EO1 image, ISO image, etc.
Support RAID recovery, including RAID0, RAID1, RAID5, RAID6, RAID5e, RAID5ee, and HP dual cycle, allowing the options of auto/manual analysis.
ExtremeRI provides first-class fragment rebuilding technology into DRS, going deep into free sectors to scan for fragments and reconstruct files through baselevel calculation. DRS offers expected results to recover damaged photos and files, breaking through the limits of data recovery.
Support file system search and analysis which mainly includes file screening, file search, keyword search, disk search, file classification, encrypted file analysis, suspicious file analysis, confidential file analysis, MFT file analysis and registry analysis.
Support thumbnail viewer.
Support scanning lost partition, and the custom scanning partitions is based on partition type and size.
Support fast scan mode and advanced scan mode, which make recover data more flexible and efficient.
Support breakpoint restore function which skips the recovered file to shorten the recovery time.
DISK DIAGNOSTICS & FIRMWARE RECOVERY
Be able to scan the source disk in advance. With fairly new FastCheck technology, it can allow rapid check with 5 seconds, avoiding raising the risk of damage to storage stack and greatly reducing work risk.
Fast recovery on common firmware problems, hidden sectors and unlock ATA encryption.
Two bad sector scan modes are offered for HDD, the fast scan and the deep scan, to detect HDD bad sector status.
Support view data in any sectors.
Possess the core value out of the past 15 years experiences, DRS aims to provide complete solution to firmware damage, supporting all popular brands including Seagate, Western Digital, Maxtor, Hitachi, Samsung, Fujitsu and Toshiba, in total with thousands of versions.
DISK IMAGING
DRS High-speed Image Module works for normal HDD, USB Flash, CF cards and TF cards, etc. It can copy & clone data from HDD, USB Flash, CF cards and memory sticks, which is widely applied to HDD copy by byte-to-byte and HDD image in the field of the digital forensics field.
Support imaging in bad sectors, provide solutions to stuck disk when imaging and even to inoperable sector data etc. Users can customize the configuration of accuracy to load sector data and image copy-failed sectors. The whole process of image is displayed on real time. Through anti- stuck technology, DRS offers an ideal solution to bad sector imaging.
Support copying data for IDE/SATA, HDD, USB Flash, CF cards and TF cards at high speeds, and fast copy bad sector HDD with IDE/SATA/USB ports.
Apply UDMA-133 transform technology, and the testing copy speed reaches 12GB/min.
Support reading data by forward/backward or reading repeatedly in order to extract more data.
Support identify the damaged head and adjust to selective head imaging.
MONITOR
Real-time monitoring of power, data and system log
PATTERN SCAN
Best solution for disks with bad sectors.
Only files under designated directory are scanned.
File under designated directories are instantly recovered by only clicking desired directories.
HARDWARE TECHNICAL SPECIFICATIONS
DRS Hardware Unit Technical Specifications:
Dimensions: 10.8 x 7.2 x 3.4 in (274 x 182 x 87 mm)
Weight: 4.34 lb (1.97 kg)
Supported ports: USB1.0/2.0/3.0, IDE, SAS, SCSI, SATA1.0/2.0/3.0 with built-in write-blocker
Supported drive: All Drive Brands, flash cards and RAID series
Supported file system: NTFS, FAT16/32, exFAT, EXT2/3/4, HFS and HFS+
LED indicators for main controllers
Wide working temperature range: 0℃-60℃(33.8℉-140℉)