Esta página está atualmente no estágio de tradução.
Desculpe pelo inconveniente.
UFS Explorer Technician

An advanced data recovery instrument for experts in digital forensics and other technical professionals

Supported OS: Icon Windows
UFS Technician box
for data recovery specialists
UFS Explorer Professional Recovery
UFS Explorer Professional Recovery
UFS Explorer Professional Recovery
UFS Explorer Professional Recovery

UFS Explorer Technician

Superior data recovery toolkit for the most exacting demands

  • Work with forensic images of various formats
  • Configurable disk reading procedure
  • Advanced mechanism for creating disk images
  • Support of numerous storage technologies
  • Integrated algorithms for disk decryption
  • Automatic reconstruction of complex storages
  • Versatile RAID Builder with an internal script handler
  • Multiple features facilitating work with defective storages
  • Variety of tools for efficient analysis and editing of raw data
  • Extensive reporting options, including files integrity control

Overview

UFS Explorer Technician is a comprehensive software solution which is adapted for the use in highly challenging data recovery tasks and complies with the requirements of various technical specialists, like computer forensics investigators and data recovery engineers.

In addition to physical storage devices, like hard disk drives, USB sticks and memory cards, the software works with various disk images created with professional forensic instruments, like EnCase or FTK Imager, and regular disk imaging tools. The in-built decryption techniques allow opening volumes encrypted with BitLocker, LUKS, FileVault 2 and APFS right in the software, without deciphering them in the operating system. Complex RAID-based storages are supported by the program as well, including standard, nested, custom and specific layouts – Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID and ZFS RAID-Z. The utility is also capable of dealing with a whole range of file systems employed in Windows, Linux, macOS, BSD and other environments, providing immediate access to available files, along with diverse storage technologies – Windows Dynamic Disks, Storage Spaces and deduplication, Apple Software RAID, Core Storage and Time Machine, Linux mdadm and LVM with Thin Provisioning and others. Moreover, the application is able to recover data from various virtual machines, among which is VMware, Hyper-V, VirtualBox, QEMU, XEN, etc. Supplemented with extensive reporting functionality and a mechanism of file integrity control, the software doesn't change the content of the data carrier and can serve as a reliable tool for the retrieval of credible evidence.

Furthermore, UFS Explorer Technician is equipped with a broad variety of means for maximally efficient processing of defective and unstable storage devices. The application presents an advanced procedure for opening disks with control over reading errors and a possibility to immediately save the accessed data to a "sparse" image file. Other types of disk images can also be created with the help of an embedded imager, which offers a variety of reading parameters, including ones for handling defective areas. A map with defective blocks can be generated during imaging or through the conversion of used/free file system space to mask and utilized during other operations. On top of that, the process of imaging performed by compatible external systems, like DeepSpar DDI and MRT Express/Ultra, can be managed by the software and enhanced with the possibility to use a file system map or a map emulating bad blocks. The binary content of files and storages can be analyzed and modified directly in the program with a vast range of helpful tools.

Technical specifications

Supported host operating systems:
Microsoft Windows ®: Windows ® XP with Service Pack 3 and later
Supported host computer architectures:
x86-64 (AMD64, Intel64)
Supported file systems:
Data access and advanced recovery:
Windows: NTFS, FAT, FAT32, exFAT, ReFS/ReFS3;
macOS: HFS+, APFS;
Linux: Ext2, Ext3, Ext4, XFS, Extended format XFS, JFS, ReiserFS, UFS, UFS2, Adaptec UFS, big-endian UFS, Btrfs;
BSD/Solaris: ZFS volumes;
VMware: VMFS, VMFS6.
Data access only:
macOS: HFS;
Novell: NWFS, NSS, NSS64;
AIX: Legacy JFS1, JFS2; Xinous OpenServer: EAFS, HTFS, DTFS;
Veritas Storage Foundation, HP-UX, etc.: VxFS4, VxFS6, VxFS7;
Urive: NxFS.
Recovery from complex RAID storages:
Automatic recognition of known RAID metadata, saving and editing RAID configurations
Automatic reconstruction of mdadm, LVM, Apple Software RAID, Intel Matrix, etc.
Support of most popular standard RAID patterns for RAID 0, RAID 1E, RAID 3, RAID 5, RAID 6, RAID 7, etc.
RAID-on-RAID support: RAID level 10, 50, 60, 50E, etc.
Support of custom RAID patterns via RDL or Runtime VIM
Support of "stripe"-volumes with ZFS and RAID-Z (RAID-Z, RAID-Z2, RAID-Z3)
Adaptive reconstruction of RAID 5, RAID 6, RAID 5E, RAID 1, RAID 10, RAID 0+1 and nested RAID (levels 50, 51, 60, 61, etc.) using maps of bad sectors and in case of presence of defects (reading errors)
RAID assembly from virtual disks
Support of Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID
Recovery from Dell EqualLogic Storage Arrays with degraded RAID 5, RAID 10, etc. and up to double-degraded RAID 6, RAID 60; volume data recovery (using an external data map)
Supported encryption techniques:
Full-disk encryption
LUKS encryption
Apple FileVault 2 encryption
Encryption of Apple APFS volumes
File system conversion (eCryptFS)
BitLocker and BitLocker To Go encryption
Supported virtual technologies:
Non-encrypted disk images created with specialized forensic tools (EnCase, FTK disk imager, etc.)
Simple disk images
VMware VMDK, Hyper-V VHD/VHDX, QEMU/XEN QCOW/QCOW2, VirtualBox VDI, Apple DMG, Parallels
Internal sparse format
Support of drive as a disk image (for XEN and others)
Synology Sparse iSCSI
Opening a partition/file within a storage as a virtual disk
Support of split DeepSpar DDI images
Custom "virtual image" files of Runtime Software
R-Studio image files (RDR file format)
Dynamic definition of virtual bad blocks on disk images using an external map or by recognizing a given pattern
Work with disk images created by MRT data recovery tools (sorting and combining file image chunks into an image file)
Supported technologies:
Full support:
Logical Disk Manager, Storage Spaces, Microsoft volume deduplication, Apple Core Storage, LVM with thin provisioning, mdadm
Recognition:
Providing a partition table, information about Spans and Stripes of LVM2, AIX LVM, HP-UX LVM, Apple Software RAID
Giving a partition structure for MBR, Apple Partition Map, BSD/Adaptec/Solaris/Unix Slice Map, GPT, Novel, Intel Matrix
Drobo volumes, HP EVA, HP LeftHand, Symphony SAN
Ways and means to work with damaged disks:
Advanced "Open storage" procedure with drive reading configuration
Option of read-once disk access with saving of processed data
Direct network access and processing of disks connected through DeepSpar Disk Imager, including imaging by a bitmap
Embedded disk imager with settings for read method/timeout and parameters for skipping defects
Production of a defects map during the imaging process
Conversion of used file system space to a mask
Imaging of used space with the help of a file system map
Creating "dynamic" (pattern-based) maps of bad blocks for disk images
Use of disk images instead of original disks (including ones from third-party software)
Defining damaged regions using bad sector maps created by UFS Explorer or compatible third-party tools (ACE Lab solutions, DeepSpar DDI)
Interaction with MRT Data Explorer, including the support of task files and control over disk imaging performed by MRT data recovery tools (imaging by a bitmap, choosing specific ranges, files/folders, etc.)
Supplementary features:
Tools for low-level data analysis:
Hexadecimal viewer for storages, partitions, files, file fragments
Hexadecimal editor for disks and partitions
Field highlighting
Data interpreter
Parity calculator
Storage content comparison
Bitwise "exclusive OR" (XOR) function
Parallel search
Data allocation tracing through reverse address translation
View of file fragments with virtual offsets and sizes
Indication of used file system space
Additional functions related to storage scan:
Pausing the scan
Previewing intermediate scan results
Saving scan results for further work
Full-range storage scan for all-at-once data recovery
Visualization of the scanning process
Five options for handling the existing file system
Options for work with partitions:
Detecting lost partitions
Automated partition aligning
Defining partitions manually
Auto-span tool
Reporting capabilities:
Interactive HTML report
Basic list of folders and files (HTML, CSV, XML)
Extended report on files and folders with the possibility of file integrity control (hash value, metadata test)
Report on file fragments
Recoverable data size with metadata test
Software events log
Minimal configuration:
64-bit edition of any of the supported operating systems
at least 20 MB of free space on the disk for the software executable files
at least 1 GB of RAM
Recommended configuration:
over 1 GB of free space on the disk for the program and temporary files
at least 2 GB of RAM and 4 logical cores CPU
default web browser

Software activation options

letterSoftware-based Access Key

A Sentinel SL electronic key based on the "fingerprint" of the user's computer which should be installed and stored within the system.

  • Doesn't require physical shipment

flash driveHardware-based Access Key

A Sentinel HL key on a USB-device that enables running the software when physically connected to the computer.

  • Can be transferred between different machines

The details related to the usage of different types of Access Keys along with other licensing terms and conditions are available in the End-User License Agreement.

Key features

Work with an exceptional diversity of storage formats Work with an exceptional diversity of storage formats
UFS Explorer Technician provides direct access to the intact content and allows recovering the missing data from an entire range of file systems employed by Windows (FAT/FAT32/exFAT, NTFS and ReFS/ReFS3), macOS (HFS+, APFS), Linux (Ext2, Ext3, Ext4, SGI XFS, JFS, ReiserFS, Sun ZFS, Btrfs), BSD/Solaris (ZFS), VMware (VMFS, VMFS6), together with the possibility to read volumes of Novell NetWare (NWFS), Novell Storage Services (NWFS, NSS, NSS 64), AIX (Legacy JFS1, JFS2), Xinous OpenServer (EAFS, HTFS, DTFS), Veritas Storage Foundation (VxFS4, VxFS6, VxFS7) and Urive (NxFS).
Support of forensic and other disk images Support of forensic and other disk images
Along with ordinary disk images created with various utilities, UFS Explorer Technician is capable of working ones produced by professional forensic tools, like EnCase Imager and FTK Imager, and specialized data recovery solutions, like DeepSpar DDI, MRT DE, R-Studio and others. The software makes it possible to open and browse the content of an image created for a particular drive, volume or file and allows scanning it for lost information as if it was a conventional physical storage device.
The possibility to prove the forensic reliability of data The possibility to prove the forensic reliability of data
The software provides an extended report on the available/recovered data with the information about the processed storage, its content, various details about each file, like its size, time of its creation, last access and modification, the state of its metadata and others. The integrity of the content of files can be easily controlled with the help of checksums – even a change of a single byte will become evident after a simple visual comparison of the file's hash values in several reports. A wide set of hashing algorithms can be used for the calculation, including MD5, SHA1, SHA256, SHA512 and others.
Plenty of other reporting options Plenty of other reporting options
The utility also allows creating a report with an interactive representation of the file system content that can be easily transferred to third parties and viewed in any standard web-browser. Besides, the program offers many other report types, like one on the size of the data with files/folders metadata integrity check, a basic list of folders and files in various formats, a log of the most important software events with their details, a list of file fragments with both physical and virtual offsets, etc.
Wide spectrum of supported storage technologies Wide spectrum of supported storage technologies
UFS Explorer Technician delivers efficient means for handling a broad range of technologies applied in modern storage devices. These include Windows Dynamic Disks and Storage Spaces, Apple Software RAID, Core Storage and Time Machine, Linux mdadm, LVM with Thin Provisioning, Btrfs-RAID, ZFS RAID-Z, Drobo's BeyondRAID, Synology's Hybrid RAID and other specific implementations. The application also supports the technology of Microsoft data deduplication (Windows Server), making it possible to restore data lost from deduplicated volumes with NTFS and ReFS.
Instant unlocking of encrypted volumes Instant unlocking of encrypted volumes
The program recognizes most common technologies of disk encryption, including LUKS, BitLocker, FileVault 2, APFS encryption and eCryptFS, enabling access to the available files and recovery of lost data from encrypted volumes, provided that the user knows a password/encryption key. It is not necessary to enter the operating system and decrypt the drive – you can simply input the password/key in the software interface and it will use it to decode the storage for further manipulations.
Access to RAID files and effective data recovery Access to RAID files and effective data recovery
The software is able to automatically reconstruct different RAID patterns, including non-redundant RAID level 0 and JBOD, 1 and 1E mirrors, levels 3 and 4 with dedicated and 5 and 6 with distributed parity as well as nested RAID setups. A special syntax allows defining custom RAID configurations with various data distribution algorithms. The utility can also adaptively restore a defective RAID set using parity (for RAID 5 and RAID 6) or a copy of data (for RAID 1). RAID can be also reconstructed using disk images with the emulation of bad sectors with the help of bad sector maps.
Work with modern virtualization systems Work with modern virtualization systems
UFS Explorer Technician supports virtual disks used by popular virtual machines, including VMware, Hyper-V, VirtualBox, QEMU and XEN, works with them as if they were just physical devices and makes it possible to navigate them or recover data even when they are stored on RAID or on another virtual machine. For example, the user can build RAID storing a VMware ESX virtual machine (VMFS file system), open a virtual disk directly from VMFS and restore files directly from the virtual machine without the need to retrieve the virtual disk first.
Controlled disk reading procedure Controlled disk reading procedure
UFS Explorer Technician makes it possible to select the method of data access and choose an I/O timeout for cases when reading is not successful due to an I/O disk error. A "read-once" feature allows avoiding excessive read requests to the same location on the storage and save the processed information to a sparse image file, eliminating the load on failing devices and keeping them from the imminent breakdown.
Advanced disk imaging possibilities Advanced disk imaging possibilities
The program allows creating a full clone of a disk or modifying the imaged area either by defining ranges on the storage or by choosing a set of files to be copied. The in-built disk imaging tool also offers configurable parameters, like reading timeout, block size, direction, protocol and settings for processing of defective areas after failed reading attempts. The faulty blocks encountered during the procedure are presented in a map file and a log of reading errors can be saved as a report.
Defining damaged sectors Defining damaged sectors
UFS Explorer Technician creates maps of defects in the process of disk imaging and works with ones produced by other compatible software or hardware systems. The utility can use such a map to emulate bad sectors on the storage or identify damaged blocks dynamically by looking for a given content template. Furthermore, it is possible to set up a mask with imitation of defects from the occupied or "free" file system space and utilize this mask for disk imaging, scanning and other operations. The masked areas can also be filled with a specified pattern.
Multiple types of scanning Multiple types of scanning
The program has several scanning options, including a quick scan for specific types of file systems, longer in-depth search for lost data by known content with the possibility to load custom IntelliRAW rules, scanning of the space occupied by the file system or just the "free space" areas. The scanning process can be paused for the review or saving of intermediate results and the final result can also be saved for further usage.
Sector size mutation Sector size mutation
While a sector size of a usual hard drive is 512 bytes, some systems, like NetApp, EMC, HP, etc. employ proprietary block formats, preventing access to data on their storage devices without specialized hardware. UFS Explorer Technician works with SCSI and SAS drives of non-standard sector sizes (520 bytes, 524 bytes, 528 bytes and others) and carries out automatic sector conversion in the typical size of 512 bytes through metadata truncation for access to files or subsequent data recovery operations.
Support of DeepSpar Disk Imager Support of DeepSpar Disk Imager
UFS Explorer Technician enables direct access via network and allows recovering data from drives connected to a DeepSpar Disk Imager device with the possibility to define the read timeout, block size and other settings for maximum safety and efficiency of the procedure. The imaging can also be performed by DDI on a basis of a bitmap loaded into the software. Furthermore, the program supports "split" disk images created by DDI.
Interaction with MRT data recovery systems Interaction with MRT data recovery systems
The application is compatible with MRT Data Explorer, supports task files created by this software along with defects maps associated with them and provides control over disk imaging carried out by MRT Express/Ultra, including the opportunity to image by a bitmap, choose specific ranges, files/folders, etc. Also, UFS Explorer Technician allows loading file image chunks from an MRT task, sorts them automatically and fills them with the necessary spacers for further work.
Broad set of tools for efficient data analysis Broad set of tools for efficient data analysis
TUFS Explorer Technician comprises all the instruments required for effortless work with the binary content of storages, partitions, files or their fragments in a hexadecimal mode. A multifunctional hexadecimal viewer with a raw data inspector, position bookmarks, structure templates, reverse data address translation, parallel search, data comparison and other features considerably assists in data parsing while a hexadecimal editor with a variety of helpful options enables it convenient manual editing.

When to use UFS Explorer Technician

screen
Get access to files or cope with data loss common storage media: hard disk drives, USB sticks, memory cards, etc.

The utility effectively works with various linear storage devices, including internal as well as external hard disk drives, USB flash drives, memory cards and many others, thus serving as an essential data recovery tool for handling most typical cases of data loss, like accidental deletion of files, storage formatting, malware attack, hardware or software malfunction, etc.

screen
Recover data from complex storage systems: RAID and RAID-based devices

UFS Explorer Technician is an efficient solution for restoring data from RAID of different complexity, both software and hardware, and various RAID-based storages, like DAS, NAS and SAN. Moreover, the software makes it possible to perform data recovery from systems that apply specific RAID configurations, like Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID, ZFS RAID-Z, Dell EqualLogic and HP MSA with diagonal XOR.

screen
Work with devices implementing specific technologies: Apple Core Storage, LVM with thin provisioning, Storage Spaces, etc.

The software is enhanced with wide support of modern storage technologies employed in different environments. It allows processing composite volumes, including Apple Core Storage, LVM with thin provisioning, MS Storage Spaces and Dynamic Disks, deduplicated NTFS and ReFS partitions, SCSI/SAS-drives with non-standard sector sizes, etc. which significantly expands the list of target devices it can be applied to.

screen
Access or restore files from encrypted storages: LUKS, FileVault 2, BitLocker, APFS, etc.

The application is able to decrypt disk volumes for data recovery and data access purposes (if the encryption key is known). The list of supported methods includes LUKS, FileVault 2, BitLocker, encryption of Apple APFS volumes and eCryptFS.

screen
Create forensic reports on the retrieved data

The program is able to generate an extended report on the data which may be particularly beneficial for forensic experts. Such a report contains the list of available files, their properties, checksums calculated for them using the chosen hashing algorithm together with the information about the scanned storage, the date of the scan and the time when the report was created.

screen
Retrieve files from defective disks

The application gives the possibility to recover data from storages that have damaged sectors or other hardware issues with maximum efficiency. Not only it offers highly configurable disk reading and imaging procedures, but also generates a map of bad blocks during the imaging process. In addition, virtual bad blocks can be defined dynamically on disk images by recognizing a given pattern or by reading bad sectors maps created by other compatible solutions. The software also allows converting the used or free file system space to a mask with emulation of defects and use it for imaging/scanning. Bitmap-based imaging via DeepSpar DDI is supported by the program as well.

screen
Open or recover data stored in virtual machines: VMware, Hyper-V, VirtualBox, etc.

UFS Explorer Technician effectively deals with disk images and virtual disks created by major virtualization software, like VMware, Microsoft Hyper-V, VirtualBox, QEMU, XEN, etc. and successfully copes with data recovery from such storages as though they were ordinary physical devices.

screen
Work with "disk-on-disk" storages of any hierarchy

The software is capable of imitating work of virtualization software and consequently provides access and restores files from multi-level virtual storages with no additional operations required. For example, the user can scan a virtual disk stored inside another virtual disk and promptly retrieve files that were lost or deleted from it.

screen
Reconstruct damaged file systems: Windows, macOS, Linux

A set of tools integrated into the software allow effectively solving practically any case of logical data loss, including the most severe ones. The program will either simply read file system metadata or conduct its detailed analysis and predict the allocation of files based on the file system specifics, allocation of other files or file content analysis to produce the best possible data recovery result.

Deixe um comentário

Ficamos sempre felizes em receber feedback de nossos clientes e agradecemos todas as sugestões para melhorar a qualidade do software UFS Explorer.

We appreciate your interest to UFS Explorer. Join us on social media to get regular updates about the software.