Active@ Disk Editor uses a simple, low-level disk viewer which displays information in binary and text modes at the same time. You can use this view to analyze the contents of data storage structure elements such as:
Template view shows parsed records of the most important areas on disk, allowing easily interpretation and editing. When you navigate to a point of interest, a proper template is selected automatically. The following templates are supported: MBR, GUID Partition table, NTFS boot sector, NTFS MFT file record, FAT boot sector, FAT32 boot sector, FAT directory entry, exFAT boot sector, exFAT directory entry, HFS+ Volume header, HFS+ Catalog Node, HFS+ File Record, Ext2/Ext3/Ext4 superblock, Ext2/Ext3/Ext4 inode, UFS superblock, UFS inode, LDM structures.
As you edit data in Hex, ASCII or Unicode pane or in Templates window, modified data is fully synchronized between views. After each modification a template view is recalculated giving you an up-to-date interpretation of data.
MFT file record template shows data at a high level of details using multiple levels. You can examine a standard header, all attributes and attribute data of the record. The attributes interpreted are: $STANDARD_INFORMATION, $ATTRIBUTE_LIST, $FILE_NAME, $OBJECT_ID, $SECURITY_DESCRIPTOR, $VOLUME_NAME, $VOLUME_INFORMATION, $DATA, $INDEX_ROOT, $INDEX_ALLOCATION, $BITMAP, $REPARSE_POINT, $EA_INFORMATION, $EA, $LOGGED_UTILITY_STREAM.
Some records like boot sectors have their copies. Templates view automatically detects records supporting copies and shows both main and copy values allowing to compare them. You can arbitrary set an offset of main record and its copy.
Individual template fields are colored in hexadecimal pane giving a quick overview of all data. As you travel along fields in Templates window, the current field is highlighted in Hex pane. Hover mouse over a colored field to get a tooltip with additional information.
exFAT boot sector as well as all types of exFAT directory entries are supported giving you a detailed information on different exFAT structures. Move template offset up/down feature allows easily navigate between records.
You don't need to guess what is the sector of root directory on FAT volume is or where is $MFT record on NTFS partition located. Simply use fast navigation points set up in the menu. When Disk Editor opens an object, the most important areas are detected and automatically added to the list. They include boot sectors, FAT tables, root directory, $MFT and $MFT Mirror and others.
It might be handy to fill an area on the disk with particular data. Besides simply zeroing an area by providing 00 as hexadecimal value you can specify any hexadecimal or text pattern for better flexibility.
Work with hexadecimal, ASCII or Unicode representation of data. Editing data in Unicode pane allows to enter extended characters directly while ASCII and Hexadecimal panes gives you control over individual bytes.
Properties window gives a concise overview of disk or partition opened in Disk Editor. If unwanted this information can be hidden to save screen space.
When analyzing large amounts of data don't get lost when navigating between different points. Easily bookmark locations by keyboard shortcuts and cycle through them. If you need even more flexibility, you can give any bookmark a name and navigate between them using a bookmark window.
As you move a cursor along, data under cursor is automatically interpreted and shown in Data Inspector in different formats. You can see them as one to four byte numbers as well as time and other useful structures.
Search data by ANSI, Hex or Unicode pattern. To speed up the process you can ask to search only at given offset inside used-defined blocks. Regular expressions and wildcard are even greater expand search capabilities.
Examples of using regular expressions:
^\d\d?$ - match integers 0 to 99
^\S+$ - match strings without white space
\b(mail|letter|correspondence)\b - match strings containing 'mail' or 'letter' or 'correspondence' but only match whole words i.e. not 'email'.
Open raw image created by Active@ Undelete or other Active@ products and investigate it with Disk Editor.
Third party disk image files such as Virtual PC Disk Image (*.vhd) or VMware Disk Image (*.vmdk) are also supported.
Many templates contain hyperlinks allowing to easily navigate to important data points.
For example, MFT records contain links to first cluster in data runs and MBR provides links to partitions.
This software is not reviewed yet.
Active@ Hard Disk Monitor is a freeware disk utility that monitors the status of your hard drives and scan for bad sectors. The system is based on the Self-Monitoring Analysis and Reporting Technology (S.M.A.R.T).
Active@ LiveCD is tool set which helps you to recover lost data, reset passwords, back up computers, securely erase data.
Active@ KillDisk for Linux (Console) is a powerful utility that will: wipe confidential data from unused space on your hard drive; erase data from partitions or from an entire hard disk; destroy data permanently.
Active@ KillDisk provides the ultimate solution how to erase hard drive data in such a way that no one can ever retrieve it using third-party software or any other method. The Ultimate version contains now complete Linux Installation.
Losing important data due to accidentally deleting it or formatting a disk can leave you in a very bothersome situation. Fortunately, however, the latest version of Active@ UNDELETE is here to help, giving you the best chances to undelete files.