UFS Explorer Technician

Extensive support for diverse file systems

UFS Explorer Technician offers direct access to the content and the possibility of data recovery across a broad spectrum of storage formats used by Windows (FAT/FAT32/exFAT, NTFS and ReFS/ReFS3), macOS (HFS+, APFS), Linux (Ext2, Ext3, Ext4, SGI XFS, JFS, ReiserFS, Sun ZFS, Btrfs, F2FS), BSD/Solaris (ZFS), VMware (VMFS, VMFS6), and is also capable of reading the volumes of Novell NetWare (NWFS), Novell Storage Services (NWFS, NSS, NSS 64), AIX (Legacy JFS1, JFS2), Xinous OpenServer (EAFS, HTFS, DTFS), Veritas Storage Foundation (VxFS4, VxFS6, VxFS7) and Urive (NxFS).

Work with forensic and other types of disk images

The software is able to handle a wide range of disk image types, including not only standard ones, but also those created by different forensic tools, like EnCase Imager and FTK Imager, and specialized data recovery solutions, like DeepSpar DDI, MRT DE and R-Studio. With its help, users can access, explore the content and restore the lost files from almost any disk image, as if it was just a traditional physical storage device. This functionality is particularly useful for technical experts who have to deal with digital evidence or conduct other data recovery tasks involving disk image files.

Ensuring forensic reliability of the recovered data

UFS Explorer Technician can be used to generate a comprehensive report containing the information about the processed storage, its content and various details regarding each file, such as its size, time of its creation, last access and modification, along with the condition of its metadata. To verify the file’s integrity, its checksums can be calculated, so that even the slightest inconsistency should become apparent through the visual comparison of its hash values across several reports. For this, software offers a wide selection of hashing algorithms, including MD5, SHA1, SHA256, SHA512 and others.

Other handy reporting possibilities

The program makes it easy to create a report featuring an interactive illustration of the file system's content, which can be effortlessly shared with third parties and viewed in any standard web browser. In addition, the software presents plenty of other report types, including a report regarding the size of the data with files and folders metadata integrity checks, a basic list of folders and files in different formats, a log of critical events happened during the program’s operation, a list of file fragments with their physical and virtual offsets, etc.

Addressing numerous modern storage technologies

The capabilities of UFS Explorer Technician cover a wide spectrum of technologies utilized by present-day storage devices. Among them are Windows Dynamic Disks and Storage Spaces, Apple Software RAID, Core Storage and Time Machine, Linux mdadm, LVM with Thin Provisioning, Btrfs-RAID, ZFS RAID-Z, Drobo's BeyondRAID, Synology's Hybrid RAID and other non-conventional setups. Additionally, the application is equipped to handle the data deduplication technology of Microsoft found in Windows Server, enabling the recovery of data lost from deduplicated NTFS and ReFS volumes.

Immediate access to encrypted volumes

The software supports a wide diversity of popular disk encryption technologies such as LUKS, BitLocker, FileVault 2, APFS encryption, TrueCrypt/VeraCrypt and eCryptFS. This allows users to access the available files and recover the missing data from encrypted volumes, as long as they possess the valid password or encryption key. There's no need to log into the operating system and decrypt the drive. Instead, the password or key can be simply provided within the program’s interface, and the utility itself will then decode the storage for subsequent operations.

Broad functionality for RAID reconstruction and recovery

The application can reconstruct a variety of RAID configurations automatically, including non-redundant RAID level 0 and JBOD, mirrored levels 1 and 1E, levels 3 and 4 with dedicated and 5 and 6 with distributed parity, along with nested RAID setups. It also offers a special syntax that allows users to define custom RAID patterns with diverse data distribution algorithms. Moreover, the utility can restore a faulty RAID array by using either parity (for RAID 5 and RAID 6) or a copy of data (for RAID 1). Likewise, the software is able to reconstruct RAID using disk images simulating bad sectors via bad sector maps.

Compatibility with popular virtualization platforms

UFS Explorer Technician can work with virtual disks utilized by well-known virtualization systems like VMware, Hyper-V, VirtualBox, QEMU, and XEN. It interacts with these virtual disks as if they were standard physical devices, enabling users to access them or recover their data, even when they are stored on a RAID set or within another virtual machine. For instance, the user can create a RAID setup that holds a VMware ESX virtual machine (VMFS file system), open a virtual disk directly from VMFS and recover files straight from the virtual machine without the necessity of retrieving the virtual disk in advance.

Customizable disk reading procedure

With UFS Explorer Technician, it is possible to gain precise control over the disk reading process. This includes an option to select the method for accessing data and set an I/O timeout for instances when reading fails due to disk I/O errors. Additionally, the software features a "read-once" capability, which helps to avoid excessive read requests to the same storage location by saving all the processed data to a sparse image file. Such an approach reduces the strain on failing devices and helps to prolong their operational life until data retrieval is completed.

Advanced disk imaging mechanism

The program offers an opportunity to create a clone of an entire disk or adjust the imaged area according to the individual demands. The latter can be done by specifying ranges on the storage or by selecting a specific set of files to be copied. The integrated disk imager also provides configurable parameters such as reading timeout, block size, direction, protocol, and settings for handling damaged areas spotted during unsuccessful reading attempts. The bad blocks encountered during imaging are documented in a dedicated map file, whereas a log of reading errors can be saved as a report.

Possibilities for emulation of faulty sectors

UFS Explorer Technician produces defect maps in the course of disk imaging and can utilize those generated by other compatible software or hardware systems. The utility can rely on such a map to simulate the presence of bad sectors on a storage device or detect damaged blocks dynamically by a specified content template. Furthermore, users have the option to create a mask that imitates defects within either the occupied or unallocated file system space and apply it in a variety of tasks. Additionally, the program offers means for filling in the masked areas with a pre-defined pattern.

Choice between several types of scanning

The program offers multiple variants of a scan to address different scenarios in the most efficient manner. The available options include a quick scan for specific types of file systems, longer thorough search for lost data by the known content with the possibility to define custom IntelliRAW rules, scanning of the space used by the file system or just the "free space" areas. The scanning operation can be paused to inspect or save intermediate results. The final result can also be saved as a file for future references.

Automatic mutation of the sector size

UFS Explorer Technician is capable of handling SCSI and SAS drives with non-standard sector sizes, such as 520 bytes, 524 bytes, 528 bytes and others. It performs automatic sector conversion by truncating the metadata to the standard 512-byte sector size. This conversion enables access to files, along with subsequent data recovery operations on particular systems, like NetApp, EMC, HP, etc. that tend to make use of proprietary block formats.

Work with DeepSpar Disk Imager

The software allows establishing direct network access and perform data recovery on drives connected to a DeepSpar Disk Imager device. Users can immediately define such parameters as read timeout, block size and other settings to ensure that the procedure is carried out with the maximum safety and efficiency. In addition, the imaging process can be accomplished by DeepSpar Disk Imager based on a bitmap loaded into the program. Furthermore, UFS Explorer Technician supports the "split" format of disk images created by DDI.

Interaction with MRT data recovery tools

UFS Explorer Technician integrates with MRT Data Explorer, supports its task files and can work with the associated maps of defects. Moreover, the software enables the user to control disk imaging performed by MRT Express/Ultra: choose to image based on a bitmap, select specific ranges, files or folders. Furthermore, the application makes it possible to load file image chunks from an MRT task, sorts them automatically and adds the necessary spacers.

Comprehensive toolkit for efficient data analysis

UFS Explorer Technician offers a complete set of tools necessary for easy handling of binary data within storage devices, partitions, files or their segments in a hexadecimal representation. Among them is a versatile hexadecimal viewer with features like a raw data inspector, position bookmarks, structure templates, reverse data address translation, parallel search and data comparison that significantly aid in manipulations with the raw data. Apart from that, the software provides a hexadecimal editor with a wide range of useful options that will significantly facilitate manual editing of the raw content.