Home > Products > Solution for Computer Forensics of File Extractor

File Extractor Provides you With “Three Unique” Forensic Conception

Along with fast development of information technology and a huge population of computer users, it is more and more difficult for the computer forensic inspector to collect useful evidence from highly skilled and experienced suspicious bodies.  The suspicious media containing criminal evidence has a higher possibility of being damaged or destroyed deliberately, rather than being performed a deletion, a format or an encryption. It becomes more and more difficult and complicated during the exploration of the criminal evidence.

1. Extract, Analyze and Validate the Data on a Working Hard Disk Drive.

Much computer forensic software such as Encase, X-Ways, FinalForensic, F-Response, etc. are designed to achieve a high performance in data restoration, data analysis, generation of auto-report and data archive. While, when the forensic investigation comes to a situation that the computer hard disk drive is malfunctioning, none of the forensic software will be able to access the data. The malfunctioning hard disk drives may behave like having severe bad tracks, corrupted Master Boot Record (MBR), or being recognized by its ‘Alias’ in BIOS.

File Extractor is designed to resolve the problems mentioned above. It can be used to extract the data from a defective drive while maintaining 100% integrity of the original data. This is one of the most significant breakthroughs in the computer forensic and data recovery industry.

2. Fully and Effectively Recover Data from Unstable and Bad Sectors Defective Hard Disk Drive

It is commonly recognized that recovering and analyzing data on instable or defective hard disk drives with instability of the read write head and the likelihood to damage platter is very difficult. Furthermore, it may also cause a further damage to the whole hard disk drive, which makes the data irrecoverable forever. The most efficient and common approach is to image the data onto a stable donor media, and then proceed to recover and analyze data from the donor.

Core Technology for Hard Disk Extract
The technology and algorithm that used to deal with the bad sectors is a crucial and critical part of a cloning tool/procedure. File Extractor possesses the superb ‘Bad Sector Leap Function’ and ‘Dynamic Balanced Enhanced Reading Technology’ help the users obtain 30% more data than the other image tools. The ‘High Efficiency Power Supply System’ function is also introduced and integrated into the File Extractor, which is used to resolve the problem of hard disk drive being irresponsive. A multiple of parameters of the reading algorithm are also set to be configurable by users, e.g. the Retry time, Readiness Time, Reset Time, which enable an optimized data recovery.

High Protection to the Source Disk
Obviously, to ensure the security of the original hard disk drive is also an important process in computer forensic.  The new technology of ‘ShadowDisk’ has been developed and introduced File Extractor after a few years hard research. This technology is also be classified as the 4th generation of image technology. The ‘ShadowDisk’ minimizes the reading times towards the source drive and protect the further damage to the source drive.

Hard disk Bitmap
The hard disk drive Bitmap can be also be analyzed by the File Extractor. Different Operation System (OS) will have different bitmap to record the cluster and sector information.  In order to find the location of specific file for cloning, the bitmap information is needed. The information is contained in FAT table in FAT system, BT table in NTFS and Block Allocation table in Linux system.

Safe Write-Protect System
Obviously, the evidence is not only the completed set of data, but also 100% compare to the original data. During the forensic investigation process, the content and the last modified time should be maintained and imaged to a donor copy. No additional data will be introduced during the whole process.

FE has built-in ‘SWPS Technology’ is used to maintain the original copy and avoids the affection by virus and Trojan which can block the accessing command beyond this rule via base monitoring to prevent all the accidental damage. Finally, it ensures the 100% intactness of the data on the source HDD when doing data recovery.This is another leading technology developed by SalvationDATA which satisfy the requirement of forensic investigation procedure where the 100% original data is compulsory.

3. Recover data at any time, any place, and any environment from any manufacturer of hard disk drives.

Portability of File Extractor
In terms of computer forensic, evidence should be collected as soon as possible and securely protected. Therefore, ensure the data is being recovered/imaged without external influence is a crucial thing during the forensic evidence collection procedure. The portability of File Extractor is designed to allow you to provide an on-site evidence collection through the USB interface. The File Extractor can be used by connecting with anyone of the laptops at any time, any place and any environment to recover data from any manufacturer of hard disk drives.

Comprehensive Supporting List
File Extractor supports a physical or logical data recovery from PATA or SATA hard disk drives, including IDE, SATA, 3.5", 2.5", 1.8" and 1.0" of different manufacturers. Also it can be used for the logical data recovery from the FLASH storage media such as USB pen drive, SD, MMC and FDD.

File Extractor supports more partition formats than the other similar tools, includes FAT16, FAT32, NTFS, Linux Native, Linux Swap, HFS+, and other peculiar partition formats used on special equipment.

Open-Source Design
The File Extractor adopts the ‘Open-source’ design on high level recovery/image software. Thus, users are free to use any one of the computer forensic program they are familiar with to work with the File Extractor, such as ENCASE, X-WAYS, FianlForensic, F-Response and so on. File Extractor eases the limitation of high level software programs to be used. This is also one of the significant breakthroughs in this industry.

Along with the development of the hard disk drive technology and the increasing complexity of unbelievable digital crime methods, the traditional forensic will not completely performance the whole process of computer forensic and reach the expected result any more. File Extractor will become the primary assistant for computer forensic specialist and leading the computer forensic industry to a new era.