Locate Sectors
Locate Sectors is a first-in-the-industry feature that helps to quickly find the exact location of specific sectors and detect which files and partitions they belong to.
It works with all file systems and devices supported in Insight and can be key when you present evidence in a court of law:
NTFS, APFS, XFS, ext4/3/2, ExFAT, HFS/HFS+, FAT32, FAT16
Each sector can belong either to a file or to an unused area (e.g. free sectors of partitions, unallocated space).
Locate sectors results in a detailed report in CSV format with details of each searched sector and its relation to the file system structure:
- Location
- Partition
- File name
- File size
- Access date
- Create data
- Modify date
Just like other reports, it is automatically saved in the case management system.
Have the bad sectors affected critical data?
This question may be asked by a judge in court.
The Locate bad sectors link in the imaging report of a damaged evidence drive takes you to the quick search of impacted files.
Locate sectors runs on the target and takes seconds thanks to an optimized scanning algorithm.
Even though the evidence drive is damaged, the bad sectors may not affect its partitions or critical data. This concise report helps you validate your evidence in court.
Where any sector’s data belongs
HEX viewer is integrated into a few modules of the software:
- Artifact Finder
- File Signatures (can be explored during or after imaging)
- Disk Editor
HEX viewer has a built-in little red pin icon for easy launch of Locate Sectors for the current sector.
Here is how it works in Artifact Finder.
Insight’s thorough Artifact Finder functionality finds evidence on the sector level as opposed to most analysis tools that analyze file systems.
You can look up the found artifacts within the sector to see their context. If you want to understand how the found artifact relates to the file system of the drive, click the little red pin icon and Locate sectors functionality will find the file it belongs to.
If the found artifact does not belong to a file, it may be remnants of the data of a file deleted by the user.
