|
View the sector space of disk devices and control the display format.
When the item in the main window of the Fomsoft Data Recovery "View" program is activated, a drop-down menu appears on the screen,
shown in Fig. 57.
Fig. 57. Drop-down menu in the main window «View».
The drop-down menu of the item in the main window «View» consists of three sub-items:
- Viewing disk space.
- Navigation in the sector space.
- Data interpretation format.
View the sector space of disk devices.
Fig. 58. The submenu of the submenu «Viewing disk space».
The program allows you to view the sector space of disk devices by specifying the addresses of various file items
structures, thus the following addresses of elements can be set:
View the contents of physical sectors of disk devices.
To view the contents of physical sectors on disk devices, you must use a combination of hot keys Alt+P or
call the sub-item " Physical sector " in the menu " View ". The dialog box for selecting
the viewed physical disk and the address window of the desired sector (LBA), Fig. 59.
Fig.. 59. View the contents of the physical sector 2048 on HD2.
View the contents of sectors of logical disks.
Viewing the contents of logical sectors on disk devices is done by pressing the combination of hot keys Alt+S
or call the sub-item " Logical sector " in the menu " View ". In this case, the program, depending on the type
file system displays a dialog box for entering the value of the number of the viewed logical sector, Fig. 60 or 61.
Fig. 60. Viewing of a sector of a logical disk F:.
| 
Fig. 61. Viewing the logical disk sector C:.
|
Viewing the contents of logical disk clusters.
To view the contents of logical clusters on disks, you must press a combination of hot keys Alt+C
or call the sub-item " Logical cluster " in the menu " View ". The program, depending on the type
file system displays a dialog box for entering the value of the number of the logical cluster being viewed, Fig. 62 or 63.
Fig. 62. Viewing the logical disk cluster F :.
| 
Fig. 63. Viewing the logical disk cluster C :.
|
View the contents of the MFT table entries.
To see the record of the MFT table, you can use the Alt+C hotkey combination or
by calling the sub-item " MFT record number " in the menu " Viewing ".
Fig. 64. Viewing the record FILE Record of the MFT table of the logical disk F :.
View the contents of the logical sectors of the disabled partitions.
To view logical sectors on disconnected disks (partitions), you can use a combination of hot keys Ctrl+S or
by calling the sub-item " Sector of the disconnected partition " in the menu " Viewing ".
In this case, you must enter the disk number and partition number, depending on the file system, NTFS or FAT32, the dialog
The window shown in Fig. 65 or 66.
Fig. 65. View the logical sector of partition 3 on HD0.
| 
Fig. 66. View the logical sector of partition 0 on HD0.
|
View the contents of logical clusters of disabled partitions.
To view the contents of logical clusters on disconnected partitions, you can use the combination of hot keys Ctrl+C or
call the subclause " Cluster of the disconnected partition " in the menu " View ".
In this case, you must enter the disc number and the partition number. Depending on the file system, NTFS or FAT32, the
one of the dialog boxes shown in Fig. 67 or 68.
Fig. 67. Viewing the logical cluster of partition 3 on HD0.
| 
Fig. 68. Viewing the logical cluster of partition 0 on HD0.
|
Navigation within the sector space of the device being viewed.
Navigation within the sector space of the disc being viewed can be performed from
drop-down menu, shown in Fig. 69.
Fig. 69. Navigation within the sector space of the selected type of file structures.
For ease of navigation, hotkeys can be used:
| № | Actions | Hotkeys
|
|---|
| 1 | To the beginning of the disk | Home
|
|---|
| 2 | At the end of the disk | End
|
|---|
| 3 | Back to Sector | Up arrow
|
|---|
| 4 | Forward to Sector | Arrow to down
|
|---|
| 5 | Back to two sectors | Left arrow
|
|---|
| 6 | Forward to two sectors | Right arrow
|
|---|
| 7 | Back to 128 sectors | Page UP
|
|---|
| 8 | Forward to 128 sectors | Page Down
|
|---|
Control the format of data interpretation.
The program Fomsoft Data Recovery allows you to interpret the viewed data in terms of various
elements of NTFS or FAT file structures. The format of interpretation is managed by calling the appropriate
submenu item shown in Fig. 69 or by pressing one of the function keys.
Fig. 70. Control the format of the interpretation of the data being viewed.
It is possible to interpret the data of the sector space of the disk being viewed in the following formats of file structures:
View the contents of sectors in hexadecimal format.
To view the contents of the current sectors, it is most convenient to use the function key F2.
In Fig. 71 is a view of the corresponding screen.
Fig. 71. Viewing sectors in hexadecimal format.
Display the content of two consecutive sectors in terms of recording the MFT table.
Viewing two consecutive sectors interpreted as FILE Record data of the Master File Table entry (MFT) is produced
by pressing the function key F3.
An example of displaying a record FILE Record, which describes data placed in separate areas of the disk sector space, the so-called
non-resident files is shown in Fig. 72.
Fig. 72. View a FILE Record that describes a non-resident file.
For non-resident files in a record, FILE Record contains lists of data runs, where the file data is written.
In Fig. 72 is a record describing the beginning of the MFT table. This file is named $MFT and is located
on the disk in two segments, fragments:
| № | LBA start segment | Length of a segment in clusters
|
|---|
| 1 | 786435 | 74722
|
|---|
| 2 | 26178698 | 314
|
|---|
If the file size is small, then the data of this file is located in the record itself FIE Record and does not take up space on the
carrier. In Fig. 73 is an example of the FIE Record of such a file.
Fig. 73. An example of a FILE Record that describes a resident file.
The contents of the directories (directories) of the FAT operating system.
To view the current sector in the format of the directory of the directory, you must press the function key F4.
An example of mapping directory sectors is shown in Fig. 74.
Fig. 74. Table of contents of FAT operating system directories.
Each sector of the FAT table of contents contains information on the 16 elements of the table of contents of the catalogs. Each element of t
he table of contents directory can describe information about a file with a short name in 8.3 format, a volume aunt or a long item
names in length of 13 bytes.
Table of file allocation FAT32 or FAT16.
To view the current sector in the file table format, use the function key F4.
Pressing this key again switches the interpretation between FAT32 or FAT16 modes, Figures 75 and 76.
Fig. 75. Interpretation of sector content in FAT32 format.
Fig. 76. Interpretation of sector content in FAT16 format.
The boot sector of the FAT file system.
To display the current sector information in terms of the boot sector of the FAT file system, you must use
function key F6. At the same time, the interpretation of the sector data will appear on the screen
Both for FAT16 and FAT32, races. 77.
Fig. 77. The boot sector of the FAT file system.
Disk partition table in MBR or GPT format.
The FomsoftDataRecovery program, when the F7 function button is pressed, determines to which structure
The file system refers to the contents of the current sector, from the position of the physical disk partition table to logical
sections. If the data corresponds to a GPT (GUID Partition Table) structure, a dialog box appears on the screen,
shown in Fig. 79. Otherwise, the information is displayed based on the assumption that it is
data of the Master Boot Record (MBR), Fig. 78.
Fig. 78. Table of disk partitions in MBR format.
Fig. 79. Table of disk partitions in GPT format.
The boot sector of the MFT file system.
To view the contents of the current sector in the interpretation of the structure of the MFT boot sector,
use the function key F7. When you click the content of the current sector
is interpreted as the MTFS boot sector data, Fig. 80.
Fig. 80. The boot sector of the MFT file system.
|
