Analyze device data on the byte level

Launch Disk Editor

To launch the Disk Editor module:

1. In the sidebar, go to Device Utilities > Disk Editor.
2. Click Start reading.

To prevent possible damage to an unstable media, Disk Editor won’t start reading device contents without your command.

Launching the Disk Editor module.

Disk Editor screen explained

The Disk Editor screen consists of three main areas:

1. Toolbar provides quick access to frequently used commands, like Go to sector or Save changes.
2. Hex viewer shows byte-level contents of a device in the hexadecimal format:
   • Left column contains hexadecimal offset values, meaning how far the byte array is from the starting sector of the drive.
   • Central column presents individual bytes in the hexadecimal format.
   • Right column shows corresponding values in the ASCII format.
3. Templates and Data inspector tabs are used to display sector metadata in a human-readable form, search for hex strings, and convert hex values to alternative formats.

Three main areas of the Disk Editor screen: 1 - Toolbar, 2 - Hex viewer, 3 - Templates and Data inspector tabs.

Read sectors using Hex viewer

Insight Forensic seamlessly reads device space in infinite mode: bytes are loaded automatically as you scroll the hex viewer up or down.

To quickly jump to a certain position, click the Go to sector button on the toolbar or press Ctrl+G. Two more convenient shortcuts:

• Ctrl+Home immediately brings you to the first sector of a drive,
• Ctrl+End gets you to the last sector.

To select a single byte, click it in the central column of the Hex viewer. To select multiple bytes, click the first byte of the sequence and drag a cursor to the last byte. Insight also highlights the corresponding ASCII values in the right column.

To save selection to a file, in the toolbar, go to Edit > Save selection to file or press Ctrl+Shift+S.

Locate sector: To find the exact location of a specific sector, click on the sector number with a red pin. Insight detects which files and partitions the sector belongs to and shows the detailed information about the location.

Examine file system structures

After you launch Disk Editor, it detects file system structures automatically and shows known metadata in a human-readable form on the Templates tab.

When you click a field in the Templates tab, Insight highlights the corresponding byte sequence in the Hex viewer.

Navigate through file system structures using a drop-down list at the top of the Templates tab or Back and Forward arrow buttons in the top right corner of the Disk Editor screen.

The Templates tab contains file system metadata in a human-readable form.

Supported metadata structures:

• APFS NX Container
• exFAT Boot Sector
• ext Directory Entry
• ext Group Descriptor
• ext Inode
• ext Superblock
• EBR (Extended Boot Record)
• FAT32 Boot Sector
• FAT Boot Sector
• GUID Partition Header
• GUID Partition Table
• MBR (Master Boot Record)
• HFS Master Directory Block
• HFS B-Tree header
• HFS Volume Header
• NTFS Boot Sector
• NTFS Index Buffer
• NTFS File Record
• XFS Inode
• XFS Superblock

Edit sector contents

As its name suggests, Disk Editor lets you modify any sector contents. You can edit individual bytes directly in the Hex viewer or paste the previously saved byte sequence from a file.

To edit a byte directly, select it in the Hex viewer and enter a new value. You can use standard Copy (Ctrl+C) and Paste (Ctrl+V) commands as well.

To paste the previously saved byte sequence from a file, in the toolbar, select Edit > Paste from file or press Ctrl+Shift+V.

Modified bytes are colored red.

To revert the last changes, use standard Undo (Ctrl+Z) and Redo (Ctrl+V) commands in the Edit menu.

To write modified data, click Save changes on the toolbar or press Ctrl+S.

MBR On/Off button on the toolbar is used in data recovery cases. It swaps the last two bytes of MBR sector #0 to disable partition scanning by Windows.

Search for a string or byte sequence

To quickly find a certain byte sequence, go to the Data inspector tab or press Ctrl+F shortcut and enter a string you are searching for.

If you search the data in the hexadecimal format, select the I am entering HEX code option.

Insight highlights the found string in the Hex viewer.

Use Find previous and Find next buttons to cycle through found byte sequences.

Searching for a hex string in the Disk Editor module.

Interpret bytes with Data inspector

Understand bytes quicker thanks to the Data inspector feature. It converts hex value to decimal (8-, 16-, 24-, 32-bit integer) or binary format on the fly.

Change bytes by entering new values in the respective fields or by selecting or deselecting bits in the Binary format.

Current offset: shows the selected byte position relative to the first sector of the device.

Byte order: switches byte order between Little-endian and Big-endian modes.

8-, 16-, 24-, 32-bit integer: shows selected byte(s) in the respective decimal format.

Binary: shows the first selected byte in the binary format.

Data inspector feature in the Disk Editor module.

Disk Editor keyboard shortcuts

Navigation and search

Editing