Disk Investigator: View MFT Zone, Check Raw Data Saved On Disk Sectors & Clusters
Disk Investigator is a multi-purpose, powerful hard disk tool that lets you find raw data saved on disk partitions, and check unreadable disk clusters and sectors. The application is built to navigate through the disk sectors, while showing the raw data in HEX, TEXT, and Decimal form. This not only helps you identify identical data written on the disk partitions, but also verify the performance of data shredding utilities. If you’ve recently used a file shredder to securely delete data from disk partition, it lets you view the current raw data present on the disk. Moreover, the application gives detailed insight into disk structure, including total logical sectors, bytes per sector, sectors per cluster, cluster size, MFT start cluster, MFT zone clusters and more. Additionally, it includes a simple, yet feature-rich file explorer that lets you view files and folders saved on disk, check raw data (in Text, Dec, and Hex form) of selected file, and check CRC-32, and MD5, Hash, RipeMD, and SHA hash value.
When launched for the first time, it starts fetching disk information, including starting sector on disk, cluster distribution, total clusters etc. Once done, you will see main window, showing all the information retrieved during the scan process. It shows drive view with complete disk information, and raw data written on first sector of disk. However, you can use Sector input field and slider to navigate through disk sectors. If you want to search a specific text string from the disk, use Search option to view specified text/hex values.
Using View cluster option, you can check data on a single cluster. You can switch between Text, Hex, and Dec data forms to easily find the required information. It provides you with simple navigation buttons in bottom-left corner to navigate through clusters.
You can view files and directories on the disk by switching to Directories mode from View section. It shows all the folders and files saved on selected disk partition. A small disk explorer is present in left sidebar, letting you quickly jump to required directory.
Perhaps, the most useful option of file explorer is View raw file contents, which allows you to view raw data (text, dec, and hex form) of any selected file. Just right-click the file in the list, and select this option to open disk sector where file is saved. You can also open file’s Property dialog box, view CRC-32 and generate file integrity hash values from right-click context menu.
The application also lets you view MFT zone (Master File Table), an area on disk where information about files and directories is saved. The MFT is basically table of contents of a NTFS disk, allowing you to verify the structure of files and directory storage. Using Disk Investigator, you can view the MFT Zone from View menu.
Directory Investigator is meant for proficient users. If you’re familiar with Hex and Dec data forms, you can use it to check the password text saved on the disk, find the total occurrence of specific file-related information etc. Disk Investigator can also be used to verify the performance of file shredding utilities that claim to securely delete data off the disk partitions. It works on all versions of Windows. Testing was carried out on Windows 7 64-bit.
Disk Investigator cannot access unmounted/unformatted partitions. This would be useful when checking partitions that appear as Raw, unallocated or Free under Disk Management utility, but which may actually be encrypted partitions or contain data from older (overwritten, lost or corrupted) partitions.