Identification of different storages and technologies for further processing in UFS Explorer

Identification of storage technologies

The demands for greater security, faster performance and higher cost-efficiency encourage the expanding diversity of technologies that complement traditional storage devices. Besides changing the way how we configure and manage the storage, the implementation of modern storage options often impact the approach taken for addressing data loss issues.

As a matter of fact, to enable a successful recovery of lost information, most of the storage technologies need to be treated differently. Yet, it is not always evident which of them is deployed on a particular device, especially in the context of data recovery services or digital forensics. UFS Explorer makes it easier to work with various storage technologies by providing useful hints. They may be of much help for understanding the crux of the case you are dealing with and what steps are to be performed next.

The following materials describe how different storages are identified in the program. In addition, some important hints are provided as to the state of the processed device or logical volume.

Icons for physical or virtual storage devices

Different types of icons are used by the software to denote stand-alone physical or virtual storages and reconstructed complex storage systems:

  • Linear storages

    • icons Physical storage device

      This icon is used for various types of simple physical digital media, like computer’s internal hard drives or SSDs, memory cards and portable USB storages, including USB sticks and external drives.

    • icons Direct ATA access

      This icon appears when a drive connected via the ATA interface is opened for reading in a controlled mode in lieu of the standard system procedure, for instance, using the “Open storage device (advanced)” option. In this case, it is the same physical storage device, but access to it is performed in another mode, without the default disk polling procedure that is likely to cause problems for defective drives.

    • icons Direct ISCSI access

      This label is used for an ISCSI drive that is being accessed in a controlled mode in lieu of the standard system procedure, for instance, via the “Open storage device (advanced)” option. In this instance, the same physical storage device is accessed in another mode which allows skipping the disk polling procedure performed by the system by default.

    • icons Non-accessible drive

      The exclamation mark may appear for drives the access to which is prevented by a certain external mechanism, for example, by System Integrity Protection (SIP) in macOS.

    • icons Disk image or virtual disk

      This icon is displayed for an opened file representing a virtual data carrier. Such a file may contain a full or partial copy of a storage device (disk image) or be used a substitute for a physical drive by a virtual machine (virtual disk), for example, *.vmdk, *.vhd, *.vhdx, *.vdi, *.qcow, *.qcow2 and others.

    • icons Transformed storage

      This type of icon is assigned to a disk after its decryption with the help of the deciphering techniques embedded into UFS Explorer (for BitLocker, LUKS, FileVault 2, etc.).

    • icons Network drive

      This label is shown for drives that were connected over the network via iSCSI or via the Agent in the Network RAID edition of UFS Explorer.

    • icons DeepSpar drive via network

      This icon is displayed when a defective drive is connected to a computer with the help of the DeepSpar Disk Imager device. Such drives can be operated by the software via LAN.

    • icons DeepSpar drive clone

      The label is used for the target drive which is connected directly to the computer and contains the data copied from the source disk via DeepSpar Disk Imager and the map of defective blocks.

    • icons MRT Data Explorer

      This sign appears in UFS Explorer for a drive with an applied MRT Task file that was created by MRT Data Explorer. Such drives can be processed in the program by means of the MRT hardware/software solution.

  • RAID-based systems

    • icons Complex storage

      This label appears for RAID and other RAID-based complex storages assembled by the software in a virtual mode.

      Additional indications:

      • RAID* (*drives) – a redundant array of independent drives (RAID) of one of the standard configurations;

      • JBOD – multiple hard drives combined into a single unit without redundancy;

      • Beyond RAID – a special RAID-based technology used by Drobo;

      • zpool::* – a non-standard RAID configuration based on the ZFS file system;

      • Btrfs::[* drives] – a Btrfs file system created on top of multiple storage devices.

    • icons Degraded complex storage

      The icon is applied to storage arrays assembled by software and shows up when its component (or several components, depending on the configuration) has failed or hasn’t been attached properly to the computer. The complex storage can still be processed, but one should be aware that it is functioning in a degraded mode.

Icons for logical volumes

There are two kinds of icons employed by UFS Explorer for logical volumes: ones that describe their state or accessibility and ones that refer to specific storage technologies implemented on them:

  • State of the available file system

    • icons Accessible

      The green icon means that the available file system can be accessed and that the boot records as well as file entries are found for this volume.

    • icons Needs attention

      The yellow icon signifies that there are certain issues with the volume, and it may not be accessed properly. Also, this color may denote an empty partition or one with a proprietary file system, such as DHFS on CCTV appliances.

    • icons Parsing error

      The red icon signals that there are serious problems with access to the volume content, for example, in case of a corrupted root directory or damaged file system.

    • icons Not recognized

      The gray icon states that the file system applied on the volume cannot be identified or is not supported by the software.

    • icons Deleted

      The red “X” icon means that the volume has been restored from the copy of metadata but the reference to it is missing.

  • Volumes with specific technologies

    • icons Component of a complex storage

      This label is used for partitions that have been identified as parts of a RAID system or JBOD.

      Additional indications:

      • Span component partition – a volume belonging to JBOD;

      • Software Mirror partition – a mirrored volume (part of RAID 1);

      • Software RAID* partition – a constituent of RAID.

    • icons Swap partition

      This icon indicates a service partition that is used in a Linux-based system as overflow space for the RAM.

    • icons Encrypted volume

      The padlock icon means that the volume is encrypted and has to be unblocked in the software using the respective decryption technique.

      Additional indications:

      • APFS partition – a volume encrypted using the standard means of the APFS file system (only in combination with the padlock icon);

      • BitLocker partition – a partition encrypted with the BitLocker security feature of Windows;

      • FAT* partition/ ExFAT partition – a partition on a removable drive that was encrypted with BitLocker To Go (only in combination with the padlock icon);

      • LUKS partition – a partition encrypted by the Linux LUKS technology.

    • icons Partially encrypted BitLocker partition

      The gray padlock icon denotes a BitLocker partition whose encryption wasn’t accomplished in full due to interruption of the process or other issues.

    • icons Deduplicated volume

      NTFS or ReFS volumes are displayed with this icon when the Data Deduplication featured is enabled for them.

    • icons Part of a composite volume

      This icon can be used with a partition that serves as a crucial element for work with a composite virtual volume.

      Additional indications:

      • LVM-meta partition – a partition that contains LVM Metadata for thinly-provisioned volumes of Linux LVM;

      • Apple Core Storage partition – a Data Partition located on the SSD component of Apple Fusion Drive or a Data Partition on a storage encrypted with Apple FileVault 2;

      • MS Storage Space partition – a constituent of a Storage Space virtual volume of Microsoft.

    • icons WD My Cloud volume

      A cloud icon is displayed for a partition that keeps user data on WD My Cloud Home and WD My Cloud Home Duo models of NAS.

For more detailed information as to the support of the given technologies by different UFS Explorer products and for links to the respective data recovery tutorials, please refer to the storage technologies page.

Last update: September 23, 2021

If you liked this article, you can share it on social media: