Disk forensics tool

Description

This is a Windows software application designed for anyone involved in disk forensics. It is simple, fast, and user-friendly, exclusively compatible with Windows platforms. The software offers numerous features, including the enumeration of available hard disks and the display of essential information about their geometry (sector size, number of cylinders, disk size, etc.) and layout (partitions and their attributes and positions). Additionally, it can identify NTFS volumes within a hard disk, enabling the parsing of their contents, particularly MFT and INDX records, which are crucial for any disk forensics engineer. You can navigate to any sector on a disk and adjust the number of sectors read at one time (the default is 1). This feature is important because, for example, an MFT record’s size is generally 2 sectors. To parse it, you need to read 2 contiguous sectors. It also adds a command item to the context menu displayed by right-clicking any volume in your file explorer window, as shown in the uploaded image. You can directly parse a specific volume by selecting this command, which is named “parse.” This software is multithreaded, allowing you to work on multiple disks or volumes simultaneously by opening a new window. I hope you will find it useful.