Es una de las actualizaciones más grandes del PC-3000 hasta ahora, y trae consigo muchos cambios y mejoras!

El equipo de ACE Lab está seguro de que ayudará significativamente a los usuarios del PC-3000 a aumentar la tasa de recuperación de sus unidades modernas.

Los desarrolladores de ACE Lab están constantemente mejorando la funcionalidad del PC-3000 y trabajando intensamente en los nuevos modos, añadiendo nuevas familias de unidades y resolviendo los problemas más urgentes.

En los últimos meses, ACE Lab ha realizado un trabajo tremendo en la investigación de las unidades modernas de Western Digital, lo que ha resultado, entre otras cosas, en la adición de nuevas funciones importantes para los HDD con traductores T2 dañados o borrados.

¡El poder del Data Extractor y la Utilidad de Western Digital ahora le permite recuperar datos de WD SMR incluso si la unidad fue formateada, los datos fueron eliminados o TRIMed!

El nuevo modo AFH integrado dentro de la Utilidad de Seagate causó cierta controversia entre nuestros usuarios y los desarrolladores de ACE Lab. Esta función, investigada hace casi 5 años, no se ha añadido al software durante mucho tiempo debido al riesgo de influencia negativa en los HDD de Seagate. Finalmente, en respuesta a numerosas solicitudes, esta función se ha implementado en la actualización actual del PC-3000 – 7.4.x.

NOTA IMPORTANTE: Instamos a todos los usuarios que deseen probarlo a ser extremadamente cuidadosos durante la operación AFH. Si no está seguro de si puede ayudar a su unidad, es mejor no usarlo. Asegúrese de mantenerse en contacto con el Soporte Técnico de ACE Lab.

Nuestra recomendación: utilice esta nueva función sólo si ya ha probado todas las opciones posibles y comprende claramente el riesgo de fallo completo de la unidad.

Nuevos cargadores SSD para las marcas de controladores más populares están esperando su PC-3000 SSD, así como las nuevas Utilidades Phison NVMe para controladores basados en PCIe 4.0 GEN.

Los ingenieros técnicos de ACE Lab han realizado un breve vídeo de resumen de las nuevas características disponibles en la última actualización. Le recomendamos encarecidamente que lo vea de principio a fin para comprender mejor cómo funcionan los nuevos modos y características.

(Del sitio web de ACELab, traducido al español por nosotros).

Puede revisar la lista completa de actualizaciones que ya tenemos disponibles en nuestro laboratorio visitando esta página:

Supermassive Software Update: PC-3000 Ver. 7.4.x, Data Extractor Ver. 6.4.x, PC-3000 SSD Ver. 3.4.x

Necesita recuperar sus datos? El especialista está en línea!

Solicite Ayuda Ahora al 55-4522-9785

Origen

LISTA DETALLADA DE ACTUALIZACIONES ENERO 2024

PC-3000 HDD (Express, UDMA, Portable)

PC-3000 Utilities

WD Marvell HDD:

ADDED – building addressed/non addressed areas of 190 SA module’ option on SMR drives in DE
ENHANCED – reading algorithm of used areas in 190 SA module on WD SMR drives (this option didn’t work before for drives launched with uploaded LDR)
ADDED – an option for all modules reading algorithms to choose a way of 190 SA module reading (only used areas / the whole module)
ADDED – 4F ROM module recovery mode
ENHANCED – HDD configuration editing mode for User Area access
ADDED – Re-Configuration mode for faster access to SA (now drive handle an error for BAD sectors in SA much faster)
ENHANCED – «Slow responding fixing» option
ENHANCED – 02 SA module editor, section editor option has been added
ENHANCED – plugin for ROM editor
ENHANCED – resources editor
ENHANCED – Power Up Log option
ENHANCED – Flash Dir editor option
ENHANCED – translator data parsing in 190 SA module for 3.5″ SMR drives
ENHANCED – logical defects to physical format converting process
ENHANCED – Boot ROM mode
ENHANCED – WD Active utility reading method
ENHANCED – ‘Read only used areas’ option has been added into the «Read and analyze T2» option
ENHANCED – utility speed and overall stability

Seagate F3 HDD:

ADDED – new families CF = «M15» and D1 = «V15X»
ADDED – ROM Tech Mode unlocking preparation patch (UnLock) type 1 for alternative family code 79 = «Crawford»
ADDED – ROM Tech Mode unlocking preparation patch (UnLock), type 1 for family code CF = «M15»
ADDED – ROM Tech Mode unlocking preparation patch (UnLock), type 1 for family code D1 = «V15X»
ADDED – an option to disable «LED BD FAdr 8004” in RAM for “Work with Flash ROM image file” (based on DiskFW)
ADDED – an option to disable «LED BD FAdr 8A19” in RAM for “Work with Flash ROM image file” (based on DiskFW)
ENHANCED – switching of COM port speed rate for Loader uploading via terminal
ADDED – support of additional MCMT formats for plugins, tests and utility actions (including DE options).
Currently 10 formats are supported: MCMT Ver 348 – 8C/A5, 348 – A1, 348 – 79, 348 – 8B, 348 – 9B(4T), 348 – 9B(6-8T), 348-AF, 348 – AD, 348 – D1, 348 – CF

ADDED – Data Extractor utility mechanisms to perform the following functions:

– getting a list of Media Cache extents
– work with extents uploading and reading one by one (or by groups) for damaged MCMT (Media Cache Management Table)
– reading stored data in Media Cache marked as «committed in UA (User Area)»
– getting a list of TRIM extents described in MCMT (MCMT cleaning is needed) for reading

ENHANCED – Hex-editor built-in plugins:

MCMT.Parser – added analysis of lost extent descriptors, auto-generation of the extent map and TRIM extents map from the utility for DE task

MCMT.Edit – added ability to correct data getting after damaged areas reading via SA LBA (for last ‘word’ of each physical sector value 0000 is assigned) on part of the table describing extents

Samsung HDD:

ENHANCED – module size detection 02 FIT in FIT editor table
ENHANCED – the beginning of Burn-In monitoring test
ENHANCED – the beginning of Heads test for a cylinder with sector size different from 512

PC-3000 tools:

ADDED – an option to add modes to «Favourites» from the «Tools/Utility Extensions» menu
ADDED – possibility of alternative profiles naming for profile management system. The alternate name is returned by the utility. Now implemented only for WDC Marvell utility. The ROM version has been added to the profile name. Previously created profiles will be renamed if they are selected to continue working with the disk
ADDED – catalogue profile search by keyword for all modes of selecting resources from catalogue

PC-3000 kernel

ADDED – USB Host and NVMe frequencies settings for the PC-3000 Portable
ADDED – additional control of the validity of readable drive passport data to support work with a logical sector other than 512 bytes.

If the drive returns «garbage» in the passport data, applying such a logical sector size value in bytes to the IDE/SATA interface may cause user zone read/write errors. This control only affects work with a logical sector other than 512 bytes and will not lead to identification read errors if the drive returns passport data that does not pass verification

Data extractor

Enhancements for Seagate F3:

ADDED – the ability to read the current media cache on the map, or by loading several extensions from a file, in the case when an attempt to load the entire module leads to problems with the drive
ADDED – the ability to read out TRIMs to recover the deleted
ADDED – the ability to read the «surface under it» on the media cache map
ADDED – the ability to read «unloaded» media cache extensions
ADDED – the ability to read outdated media cache and surface data. This creates a disk with read data, a JBOD of the source disk and this data, and a disk based on the map of this JBOD with loaded «versions» of outdated data for editing
ADDED – an option «Detect invalid sectors» in task parameters with appropriate GREP and legend. During copying, GREP is parsed, writing the new attribute to the map, and treated as an error

Enhancements for Western Digital SMR:

ADDED – the ability to build and use addressable/non-addressable sector maps

ADDED – the ability to create a task based on the utility and in it:

– In case of «loss» of the second-level translator, create a copy of the data.
– in case of a good translator, using a map of unaddressed sectors, restore data deleted using TRIM

Other enhancements:

ADDED – the ability to create a virtual disk for any file (including compressed and encrypted), (relevant for virtual machines)
ADDED – the ability to skip passport ID reading when creating a task for NVMe drives
ADDED – possibility to make DE scripts for NVMe and SAS drives
ADDED – full support for the PDF format in RAW Recovery, with integrity and size control up to a byte
ADDED – the ability to save files in a zip archive including multivolume. As an option, archive could be additionally encrypted
ADDED – power control for USB tasks created via utility in the PC-3000 Portable
ADDED – processing of sector statuses when saving data from VHD and VHDX disks
ADDED – the ability to optionally show parameters when creating a task
ADDED – saving task parameters in !Backup after each task changing
ADDED – «Clear image files» option to settings. Managed to solve the problem with slow copying speed
ENHANCED – the algorithm of extension checking (separate body, separate extension)
ADDED – the ability to export drive image into forensic format AFF v4
ADDED – the ability to take snapshots of file systems, taking into account the marks
ENHANCED – algorithm for saving files. Previously a significant slowdown when copying a large number of small (size) files was possible
ADDED – the ability to continue saving the file. Relevant for large files
ADDED – tightened control of data validity for ExFAT file system, when parsing directory metadata
ADDED – the ability to open previously saved maps from the main menu
ENHANCED – utility speed and overall stability

PC-3000 SAS

HGST HDD SAS

ENHANCED – ROM reading algorithm for CobraB C10K147 family
ENHANCED – microcode building from donor disk resources
ADDED – additional fields to the passport data
ENHANCED – the algorithm of loading different vendors’ microcode for all families
ADDED – parsing modules’ table from RAM for HUH7210xALx20x (AriesHC10) family (not all modules were read) and reading-writing of modules
 
Por eso somos Los especialistas en recuperacion de datos en México.
 
Solicite ayuda ahora! 55-4522-9785

Origen

ACE Lab Webinar gratuito acerca de recuperacion de datos de RAID

En septiembre de 2022, ACE Lab impartió un seminario web gratuito acerca de la recuperación de datos de RAID, en donde sus ingenieros nos contaron más acerca de la recuperación de datos de RAID, tips y trucos, y mostraron guías de como resolver casos de RAID de la vida real, además de responder preguntas técnicas.

Ahora, el webinar está disponible para tí.

– Mitos acerca de la recuperación de datos de RAID.
– Que es RAID?
– Principales problemas en la recuperación de RAID.
– Guías para resolver casos.
– Demostración de la vida real.
– Preguntas y respuestas.

Más acerca de PC-3000: https://www.acelab.eu.com/
Blog de soporte (parcialmente abierto al público, en inglés): https://blog.acelaboratory.com/

Si requieres recuperación de datos o capacitación al respecto, contáctanos!

Origen

Video conferencia TechCon Data Recovery & Digital Forensics 2021

Conferencia impartida por especialistas de ACE Lab en Abril de 2021. Se trata de la reunión más grande de especialistas en recuperacion de datos y expertos forenses.

Vemos las nuevas perspectivas tecnológicas, métodos de recuperación modernos, consejos y trucos, además de algunas guías prácticas.

0:00:00​ – Apertura.
0:04:08 – ACE Lab: Ayer, hoy y mañana.
0:09:50 – Siendo exitoso en recuperación de datos y evidencia.

Los retos actualizados en recuperación de datos de discos duros: RESUELTOS.
0:46:46 – Western Digital: Nuevas familias y recuperación de datos de T2.
1:15:00 – Seagate: Rosewood SSHD con NAND dañada.

Hacia adelante con la recuperación de SSD! Que hay de nuevo?
1:47:31 – Lo nuevo en la actualización del software de PC-3000 SSD.
1:51:34 – Lista de soporte extendido: SSDs agregados este año.

NAND Flash data recovery: Perfeccionando la excelencia.
2:18:21 – Nuevos algoritmos de imagen y pinout BUS detection.
2:25:25 – PC-3000 Flash. Casos de estudio de la vida real.

La evolución de Data Extractor y Data Extractor RAID Edition
2:42:33 – Nuevas características y ejemplos del uso de additional maps.
2:54:19 – Una forma más rápida de detectar la configuración de RAID.
3:16:25 – Cómo verificar la configuración de RAID.

Nuevos descubrimientos: Las ultimas funciones para recuperar datos de dispositivos móviles.
3:34:00 – Retos para la recuperacion de datos de dispositivos móviles en 2020s.
3:56:35 – Actualización de software de Abril: Nuevas características.
4:01:28 – Xiaomi Redmi S2.
4:15:50 – ASUS ZenPhone MAX PRO M2.
4:30:27 – Data Decryption del dump de eMMC del Redmi S2.
4:40:18 – Data Decryption de tarjeta mSD de BQ-522.

5:01:16 – Notas de cierre.

Más acerca de PC-3000: https://www.acelab.eu.com/
Blog de soporte (parcialmente abierto al público, en inglés): https://blog.acelaboratory.com/

Si requieres recuperación de datos o capacitación al respecto, contáctanos!

Origen

Repetición del webinar impartido por especialistas de ACE Lab en noviembre de 2020.

TEMARIO:

0:00 – Introducción.
02:52 – Por donde empezar: Puntos importantes y errores comunes.
13:29 – Recursos gratuitos en línea para tu negocio de recuperación de datos.
16:35 – Escogiendo tu área para recuperación de datos y equipo especial.
31:53 – Diagnóstico y clonado (imagen) de disco sin computadora.
38:51 – Resolviendo problemas de protección por contraseña (password-protection)/cabezal dañado (damaged heads).
52:21 – Generando el reporte para el cliente.
56:20 – Cómo lidiar con discos USB con daño lógico.
1:03:36 – Recuperación de datos de SATA SSD dañado.
1:11:58 – Lidiar con SSD NVMe Marvell.
1:19:03 – Unas palabras acerca del soporte técnico y entrenamiento.
1:24:21 – Equipando tu laboratorio con herramientas específicas y consumibles.
1:27:40 – En donde encontrar clientes?

Más acerca de PC-3000: https://www.acelab.eu.com/
Blog de soporte (parcialmente abierto al público, en inglés): https://blog.acelaboratory.com/

Si requieres recuperación de datos o capacitación al respecto, contáctanos!

Origen

LISTA DETALLADA DE ACTUALIZACIONES

PC-3000 HDD (Express, UDMA, Portable)

 
WD Marvell
 

• Added the decryption of user data function for new families (SpyGlass, Palmer, etc.);
• Improved ROM building from SA data;
• Added ROM building from SA data for Palmer family (it’s now possible to use «unlocked» PCB without re-soldering the ROM);
• Added Heads map changing in RAM feature for SpyGlass and Palmer families;
• Fixed issues with Heads map building and Slow Responding;
• Added Heads map building option for SpyGlass and Palmer families;
• The «Solve slow responding» and «Slow responding changes cancel» modes have been improved;
• Added heads zone selection filter for «Zones and heads inactivation» mode;
• Added a new option for hiding found defects «Logical scan» mode – «Hide defects as microzones»;
• For «Physical scan» mode, auto-saving of performance diagrams for heads has been made;
• Function «Hide defects as microzones» has been added to the Defect list editor for LBA and CHS tables;
• Improved Active Utility actions mode in Data Extractor. Added a new action «Custom Scenario».

 
Seagate F3 

• In HDD resources backup function, the valid copies switch is now used for Read Sys Files and Make loader;
• Added a new command to User command handler: «PWR_OFF» for switching HDD;
• Added an ability to view «Drive Tables» (DT) in Service information objects. It’s now possible to open selected object not only via DT command but also by viewing corresponding memory class (for example, Servo RAM for SAP);
• Added a Multi-tab editor «View SA resources»;
• Added a Patch for bypassing LED:BC FAddr 4040;
• It is now possible to execute the entire list or one selected action from the pop-up menu by right click mouse button in DE Active utility actions list;
• Added an ability to run Utility with Terminal switched off;
• Improved a Boot Code starting dialog:
• Added information fields Mdl / SN / FW / Log head map;
• Decoded ROM data is now substituted into profile name fields;
• Sys file 3-30A added to default SA backup list;
• Ability to run in Boot Code mode added to the start dialog;
• Added a function to upload adaptives (CAP/RAP/SAP) from the image into RAM to Work with ROM tab;
• Added a Master of complex HDD initialization;
• All in one ROM patches:
• Heads map changing;
• Init SMART Fail;
• NoHOST-BSY 1/2;
• WrProtect 87270000;
• UnlockTech;
• YetiStopStart;
• Kahuna CFW1.
• Loader uploading with Disk FW and patching on the fly:
• Init SMART Fail;
• NoHOST-BSY 1/2;
• WrProtect 87270000;
• LOD check Err xxxx0800.
• RAM/SA flag for overlays changes on the the fly;
• Post-process actions are performed:
• Unlock;
• Adaptives uploading from source;
• Heads map changing;
• Edit HDD ID (ATA / Terminal // SysFiles / «T>F»).
• Added «Force Setup State» warning message in «Unlock Tech» for SED drives about deleting encryption keys;
• Added SysFile filtering by size (files larger than 128M are ignored);
• Changed a method of determining the part size of multi-block ROM;
• Changed a dialog to add defects to Non-Resident G-List;
• In Utility status, the buttons for detecting the size of the SA sector and Utility auto-initializing are now separated by «ATA» and «Terminal»;
• Wherever the ROM is read, if you refuse to select a drive profile, saving now goes to the «@ROMBackup» folder in the root directory of the utility;
• Added an ability to disable the messages «For automatic Boot Code Mode …» and «Remove short circuit from Boot Code…» when switching to the Boot Code (enabled from Utility settings);
• Added an ability to set Terminal transfer rate in Utility settings;
• In the passport editor, added the ability to skip the switching power after the changes;
• In the MCMT.Edit plugin, added the ability to mark as incorrect MediaCache descriptors that do not contain the flag-mark of the non-loaded extent;
• In the MCMT.Edit plugin, added the ability to edit the DiscDirtySegmentCount field;
• In the MCMT.Edit plugin, added the ability for records describing the read cache (committed) to remove the flag of their presence in MediaCache;
• The check for necessary GFD ROM block is added to the generator of the loader;
  Into the generator of the loader creation of a report about the included Disk FW, which is saved to a text file, is added;
• The ability to add to the previously created loader of the GFD block from the corresponding ROM is added to the loader editor.

 
Hitachi-IBM-ARM 

• In the NV-RAM read dialog for the list of copies, HOT-KEYs has been added – “Select all”, “Select all”, “Invert selection”;
• In viewing SA objects, the restriction on the size of the PBA readable region (0xFFFF) has been removed.

 
Samsung 

• Fixed the incompatibility with Windows XP for Samsung USB HDD utilities.

 
Utility PC-3000 ATA 

• Modified logical scan. The parameter «Save defects» made as stored.

 
PC-3000 Kernel 

• Added management «thresholds» for the supply voltage HDD for PC-3000 SAS 6 GB/s;
• Fixed an error backward compatibility with earlier versions of PC-3000;
• Modified «Download Microcode» mode, added saving the type of file loaded into the editor;
• A common error handling mechanism was made for drives connected to the PC-3000 controllers. The mechanism is currently used by the ATA utility (Logical Scan in All Utilities), WD Marvell and Toshiba. Script editing is possible in the utility settings mode (ATA, WD Marvell, Toshiba). The mechanism allows you to specify a set of actions, with the possibility of a conditional transition to the next, when the successful or unsuccessful completion of the current one. For experienced users, it is possible to implement their own actions on the principle of Plugin`s;
• Modified «Performance Chart» mode:
• Eliminated the problem of «peaks» – points with abnormally high speed, which manifested itself during a scan with jumps;
• Changed error indication.
• For the PC-3000 Express complex, changes were made in the mode of sharing the ports of the PC-3000 SAS controller and PC-3000 SAS 6GB;
• For all complexes, the identified problems were fixed when installing earlier versions of the complexes for another type of PC-3000 controller on the same computer;
• In the profile management system added checking the presence of the main directories;
• In the resource editor, the dialogs for saving/loading data to/from files were added in accordance with the type of resource being edited (as implemented in WD Marvell and Toshiba utilities);
• Translated to the hardware implementation of standard protocols. Indirectly, it concerns 100% of HDD operation modes;

 
Data Extractor 

• Replaced application memory manager. This manager is significantly faster, and, which is especially important for a long-running application, allocates memory of various size more optimally, which reduces the likelihood of memory fragmentation due to different allocation “lifetime”. The use of this manager significantly reduces the likelihood of misleading errors that show the lack of memory;
• Added the possibility to work with the alternative maps filled in a process of reading/writing. A context menu of a particular drive (in explorer) is using for a map enabling/disabling. The analysis performs in a separate flow does not affect the read/write speed. There are added three types of maps:
• Constant, based on the search of disk structure headers, file systems, and some useful file types;
• Constant, based on the analysis of «entropy», useful in assessing the composition of readable data. May be used for the parameters of RAIDs with redundancy;
• User, based on the GREP search. There is a special mode for the adding of similar maps realized, available from the main menu.
• Added implementation of combining user and supplied reference books of maps based on GREP;
• For alternative maps, added the ability to change the legend and view statistics;
• Added the ability to «switch» the «map» tab to view one of the additional maps (context menu) and observe its filling in the process of creating a copy of the data. Observing, for example, the «entropy» map, one can see that the data currently being read are of the same (zeros, pattern, encrypted …) or diverse nature;
• Added the ability for USB devices, that are not connected through the utility, to apply hardware and software resets and include them in scripts.

 
Virtual drive map editing mode 

• In the explorer and for the RAW results date added;
• Added selection of the RAW results for the metadata file system NTFS record type MFT;
• Added selection of RAW results for FAT file system metadata;
• Added new functionality for automatic search and use of unambiguous results of the RAW recovery (for jpg, jpeg, png, rar, zip, doc, docx, xls, xlsx files) to form the final map;
• Added the ability when using search results, to supplement the chain before it starts;
• Added the method of combining adjacent chains.

 
«View structures» mode 

• Added the ability to navigate the structures of the FAT file system;
• Added support for the Ext file system (2,3,4) and the ability to navigate through its structures;
• Added support for the exFAT file system and navigation through its structures;
• Significantly accelerated the analysis of structures;
• Added a scrollbar in the HEX editor;
• Added display of service information for Flash;
• Fixed some display problems;
• «Parallel viewing of data sources» mode
• Added the scroll bar to the HEX-editor.
• New GREP search mode (available from map mode)
• Added the ability to build a map of search results (all or just marked ones);
• Added the ability to export search results to HTML and CSV (all or just checked);
• In the list of search results the LBA of the found match is displayed;
• In the HEX tab, if it is active, the data for the currently found match is displayed.

 
«RAW recovery» mode 

• Added search BitLocker structures: VolumeHeader and Information and the method of adding a virtual drive based on them;
• Added a method of adding virtual partition APFS based on the structure of APFS Superblock;
• Mft entries are no longer divided into groups in a RAW recovery;
• Optimized the time for searching and parsing WSS (Windows Storage Spaces) metadata;
• Improved analysis of WSS metadata — more format versions are supported;
• Added search for APFS structures;
• Opening a file has been added to editing the map on the RAW tab;
• Removed the list update after opening the result file;

 
«Quick Disk Analysis» mode 

• Added search APFS partitions.
• DE-Storage format (* .deff)
• Optimized work with memory (Reducing the required amount of memory for simultaneous work with multiple storages);
• Increased speed of access to data storage;
• Fixed «freezes» (arising when working simultaneously with multiple repositories simultaneously);
• Fixed a bug that occurred in some tasks when reading from the DE-Storage format. After the message «Not enough memory for command performing» or message in log of file reading errors, the working has been impossible.
• Virtual disk, encrypted BitLocker
• Added ability for AES-XTS partition decryption;
• Enhanced decryption.
• Virtual disk, encrypted FileVault
• Added support for disks without EncryptedRoot.plist.wipekey file.
• Added a new type of virtual disk Virtual Drive – MAP Decrypted which is used for AES-XTS algorithm decryption;
• Conversion of legend from static to dynamic is defined by the utility. It distinguishes from standard legend and used by some SSD utilities;
• In GREP search a new option added for max LBA setting;
• Increased max jump size for reading error handling and loss of readiness (up to 2147483648);
  ‘!Problem’ catalog is removed when there are no problem files;
• Added auto-detection of a plaintext HFS/APFS partition in Apple CoreStorage and ability to work with it in the initial partition;
• In parameters of export in .csv format, added options for column delimiter value and «quote» character;
  File systems

 
APFS 

• Added initial support for APFS file system;
• Encrypted volumes are now supported(user password is needed);
• Implemented ability for working with previous volume versions;
• Implemented ability to create disk decrypted by volume key (RAW recovery is available on this disk to search lost files);
• Added auto-detection and set by default the latest version of ContainerSuperblock;
• Added map creation method for Catalog Tree and FS Tree;
• Implemented detection and opening an APFS partition on 0th LBA of a disk and on the partition with unknown type;
• Implemented option for symlink saving in external file format;
• Added message for impossibility for map creation and saving of compressed files.

 
NTFS 

• An improved way for database transactions allows to significantly speed up the rate of MFT scanning, Partition analysis and Analysis of found NTFS structures;
• Analysis of found NTFS structures is optimized for big data;
• Added deduplication support (files are saved via special service) for both native partitions and analysis results;
• Improved support for EFS.

 
FAT 

• Improved algorithm for found files analysis, add a step for detailed analysis of files (via RAW recovery) without descriptors. For fragmented files part of the information was lost previously;
• An improved approach for big and long working catalogs dealing with features of ExFAT on Apple.

 
Ext(2,3,4) 

• An improved way for database transactions allows to significantly speed up the rate of Partition analysis;
• EXT4 file system, support for resident (inline) files and folders have been added.

 
HFS+ 

• Option to build a map of FS Journal has been added;
• Scan method Catalog File + Journal has been added;
• The issue about incorrect file map (repeated chains) has been fixed;
• The issue about incorrect Extents File parsing in scan Catalog File mode has been fixed;
• The logic of processing files versions for scan modes has been changed (now the complex leaves in place the most recent version of the file from all versions with full placement).

 
DHFS4.1 

• The issue about incorrect recognizing as ExtX in case of GPT has been fixed;
• Partition scan with video records has been improved.

 
BtrFS 

• The metadata scanning algorithm is optimized for working with a large number of files;
• Fixed a problem with a lack of memory during operations with directories with large the number of files and folders.

 
ZFS 

• Added support for zvol;
• Improved parsing of ZFS structures.
• The EXT (2,3,4), UFS (1,2) and XFS
• The EXT (2,3,4), UFS (1,2) and XFS file systems, changes have been made to the analysis algorithm, a step has been added to more detailed parsing (with RAW recovery methods) of files whose descriptors have not been found, and definitions for them, if possible type, names and dates.

 
Error fixing 

• E01(forensic) format export:
• Fixed error for storage creation;
• For pointing out the size equals 0, the storage is not divided into files.

 
RAID Edition 

• Fusion drive based on APFS support has been added. APFS Fusion Drive in autodetection RAID config mode is supported now;
• WSS (Windows Storage Spaces) metadata support has been improved;
• APPLE Fusion drive analysis procedure has been improved;
• Dates and sort by them have been added in explorer of RAID creating form;
• The autodetection by RAID’s metadata bypass the GPT partitions now, even if MBR was erased.

 
Por eso somos Los especialistas en recuperacion de datos en México.
 
Solicite ayuda ahora!

Origen