Request Help

Request Help

We are happy to help! Please fill out this form or call us
Call: 866-438-6932

Forensic Scan



DTI Data has received thousands of calls and emails over the years that describe a data situation that leads one to believe that there is corrupted data or some type of data anomaly caused by physical damage to the hard drive components. These anomalies are such that they do not present themselves in an easily identifiable manner and many times can only be resolved by looking at each and every one of the files on an individual basis. For many clients this type of verification can be tedious at best and mind numbingly fruitless is application.

With that being said DTI Data has designed a method within RIA Now that offers a quick and easy solution to find the vast majority of corrupted data without the painstaking ‘one file at a time’ methodology. The following is a concise, step by step method for addressing such a situation.

Step 1. Using Speed Clone for Windows make an image of the hard drive in question. This cloning allows for Speed Clone to map the bad sectors into the image so that they become easier to spot and ultimately aggregate in each file.

Step 2. Using the ‘Open Image’ function in RIA Now, load the image into the ‘Connected Devices’ list. Once this has been accomplished follow the steps for finding valid partitions outlines in either the Scanned recovery or the Simple Recovery.

Step 3. Once you have the Volume you want analyzed recognized use the ‘Forensic Scan’ button on the main display of RIA now to invoke that function. Figure 5 clearly shows the ‘Forensic Scan’ screen. In order to ‘evaluate’ a drive just use the ‘Begin Forensic scan’ button. RIA Now will now scan every file listed in the current mounted volume and evaluate each file for possibly corrupted files. Figure 5 shows the list of files that have been found on this particular volume that have corrupted data in them. Depending upon the total files and the size of the files that scan could take as long as four to six hours. It is best to let the scan complete.

Most of Figure 5 is self-explanatory but there are a few areas that need some brief explanation.

Button Save File List
This will allow the user to save a list of all of the corrupted files found to a file that can be shared with technicians, clients, or simply archived.

Bad Sectors Display
The number associated with this columnar heading describes how many bad sectors were found in this particular file. Clearly, the higher the number the more corrupt the file is.

Step 4. Once the list has been created it is time to find the files that are important to you and see if they may have some corruption. ‘Exit Forensic Scan’ in order to get back to the main screen menu. From this menu use the ‘Search Files’ function to find the files you are interested in. As an example, if you have a spread sheet that you absolutely must have simply type ‘xls’ in the mask field and ‘Begin File Search’. You will see a standard display, however and file that has been found to be corrupted will be highlighted in red. You may then follow the copy procedures to test the file. In this case read the file with Microsoft Excel and see if in fact the file is corrupt.

Comments are closed.