Locate Sectors

Locate Sectors is a first-in-the-industry feature that helps to quickly find the exact location of specific sectors and detect which files and partitions they belong to.

It works with all file systems and devices supported in Insight and can be key when you present evidence in a court of law:

NTFS, APFS, XFS, ext4/3/2, ExFAT, HFS/HFS+, FAT32, FAT16

Each sector can belong either to a file or to an unused area (e.g. free sectors of partitions, unallocated space).

Locate sectors feature helps find the sector's data relation to the file system on the drive

Locate sectors results in a detailed report in CSV format with details of each searched sector and its relation to the file system structure:

Just like other reports, it is automatically saved in the case management system.

Have the bad sectors affected critical data?

This question may be asked by a judge in court.

The Locate bad sectors link in the imaging report of a damaged evidence drive takes you to the quick search of impacted files.

Locate sectors link is a quick way to start locating all bad sectors
Locate sectors helps understand whether critical data has been impacted

Locate sectors runs on the target and takes seconds thanks to an optimized scanning algorithm.

Even though the evidence drive is damaged, the bad sectors may not affect its partitions or critical data. This concise report helps you validate your evidence in court.

Where any sector’s data belongs

HEX viewer is integrated into a few modules of the software:

HEX viewer has a built-in little red pin icon for easy launch of Locate Sectors for the current sector.

Here is how it works in Artifact Finder.

Insight’s thorough Artifact Finder functionality finds evidence on the sector level as opposed to most analysis tools that analyze file systems.

You can look up the found artifacts within the sector to see their context. If you want to understand how the found artifact relates to the file system of the drive, click the little red pin icon and Locate sectors functionality will find the file it belongs to.

If the found artifact does not belong to a file, it may be remnants of the data of a file deleted by the user.

In Artifact Finder, Locate sectors helps quickly understand an artifact's belonging to a file