| December 26, 2013 |
PC-3000 SAS V. 5.0.2 and Data Extractor V. 4.8.28 released |
PC-3000 SAS kernel
- PC-3000 SAS software has been redesigned completely to support operations with SAS HDD via the kit 4-channel SAS controller and with SCSI HDD via third party controllers; limited support for SATA, ATA, USB HDD on third party controllers has also been implemented
- Implemented separate and independent management of 4 SAS ports on the kit SAS controller
- Implemented management for the 4-channel power supply adapter
- Implemented launch of PC-3000 SAS utilities and Data Extractor tasks as independent processes in the OS
- Implemented driver support for 32-bit and 64-bit Windows 7 and Windows 8
Data Extractor
- Added parsing of MDADM structures in the explorer view
- Added creation of map-based virtual drives
- Added creation of virtual drives from VMDK files (hosted sparse extents):
- Optimized work with a new map type considerably accelerating operations with it and improving memory consumption
- Optimized work with the map during statistics calculation/updates considerably accelerating these processes
- Added support for the previous format of map description storage
- Optimized the algorithm of submap generation for the new map file type (considering the drive heads)
- NTFS:
- VMFS:
- FAT file system:
- EXT(2, 3, 4) file system:
- Added a new alternative (and more compact) map implementation for tasks with enabled copy creation option. Map variation is selected during task creation (previous format - 'Binary file'). The default value can be configured in the settings menu of the Data Extractor task manager. New map format has been supplemented with redundancy fields, which allow map recovery in case of key metadata corruption. Implemented a recovery mechanism
- Added buttons for quick control of reading taking into account the heads map (they appear on the panel to the right after the heads map is built)
- Enhanced the task window with a quick access button activating the main windows of the suite (window of the current utility for the task, PC3000 and DE managers)
- Added termination of the copy creation process upon selection of the 'Work with copy' option
- Added automatic map redrawing after read operation
- Implemented general control of recursive links in file systems and their correct handling while saving files/directories or generating their maps
- Raw recovery mode:
- Quick disk analysis mode:
- GREP search: considerably increased performance due to multithreaded execution
- NTFS:
- Ext4 file system:
- FAT file system: added the opportunity to analyze a partition using an external file as a FAT source
- VMFS: added support for the native file system
- ReiserFS:
- exFAT file system: added control of likely boot record copy during file system detection in an exFAT partition for a $07 slot
- Fixed the error preventing statistics from changing during multipass copying
- Fixed the error resulting in incorrect use of the heads map during backwards reading based on the map
- Fixed the error in map statistics calculation (taking into account the missing chains, such as sparsed, etc.)
- Fixed the error preventing serial number display for SAS devices
- Fixed rare error causing overflow of the message queue (insufficient quotes message) and memory leaks
- Fixed the error causing 'capturing' of two extra sectors under specific conditions during backwards reading with enabled option to jump upon readiness loss or upon reading errors
- Changed GPT parsing (previously interrupted at the first 'empty' slot)
- Fixed the GPT parsing error for sectors different from 512 bytes.
- Added forensics features:
- NTFS:
- HFS+ file system:
- FAT file system:
- EXT2 (3, 4) file system:
- Raw recovery mode:
- Added in the GREP reference the opportunity to export/import its content to/from an external file
- Introduced additional control of identification data of the devices connected to standard ports while opening a task
- Added the opportunity to display in the sources list the drives connected to the standard ports and used at the moment
- Changed the mode employed to control the ports/drives in use and open tasks (used ports/drives do not appear now in the lists or appear with a warning icon, tasks remain inaccessible)
- Increased writing timeout for the HDD connected to standard ports (which was insufficient for some newer "green" 2-3 Tb drives failing to wake up and resulting in writing/reading error on the destination drive)
- Eliminated map "jumping" during tab switching
- 'Statistics' item added to the main menu of the task window (for copy creation tasks)
- Fixed an old error causing "gaps" during copy creation in image files (very rare in case of straight forward copying and more often during backward copying)
- Fixed the situation when sector reading interrupted in sector editor caused termination of the running process
- Changed the task name input dialog
- File size filter now starts from 1 byte (previously: from 1 Kb)
- Added power management functionality in the object map mode
- Added the opportunity to save files with problems to a separate directory (preserving the paths) while saving files
- Removed the file saving dialog with information about files with problems. A file is now saved automatically under a unique name including complete date and time. Appropriate message is output to Log
- Supplemented the Log context menu with the command to open file (invoked by highlighting the necessary block and right-clicking it)
- Optimized the performance of 'Raw recovery' and 'Disk analysis' modes. Performance of the raw recovery mode increased by 20-30%, disk analysis accelerated several times (which is important during the complete analysis stage)
- Added output of the message about successful creation of a virtual partition to Log
- Added the dialog that allows partition creation from a specific LBA during creation of a virtual partition with unconfirmed structure
- NTFS: if MFT scanning reveals no $bitmap, the corresponding menu item is inaccessible in the analysis results
- Added a new 'Disk analysis' mode to replace the earlier 'Quick disk analysis' mode. It is performed in two stages (quick and complete), the results appear in the list immediately providing an opportunity to estimate them from the viewpoint of data recovery (delete if the data pose no interest, exclude a range of sectors in resulting data from further operations)
- Raw recovery mode, accelerated performance
- XFS: optimized the partition analysis mode as regards memory fragmentation
- Fixed the error in capacity detection for some USB drives
- Added the 'Comment' field in the raw recovery results to display additional information for the specific result type (structure or file)
- Added in the log menu the 'Open as LBA' command that allows to highlight in the log a numeric value and immediately open it in the sector editor
- Revised the rule used to generate a new file name for file duplicates encountered while saving with the 'rename' option. Now file extension is preserved and its name is supplemented with the date and time
- XFS: fixed errors in the procedures generating the directory and file map for some rare storage forms of file/directory descriptions
- EXT file system: fixed the error in the calculation of the initial sector of a file for large (>2 Tb) partitions
- Implemented interruption of the copying procedure and information output to the report for compressed NTFS files with unread sectors or sectors read with errors if the appropriate option is enabled
- Enhanced the functionality for map generation for a directory (or selected files and directories) with an opportunity to calculate the estimated total size of the files based on their descriptors without actual generation of their placement map
- The button disabling caching is transformed into a trigger (on/off).
- HFS+: fixed the error, which could prevent opening of HFS+ partitions in case of Apple Partition Map
- Fixed memory leak caused by fragmentation during execution of two or more tasks saving files in explorer and/or saving a copy to a drive connected to standard system ports
- NTFS: upon completion of MFT scanning, the number of found valid MFT records is now output to the Log
- EXT2 (3, 4) file system:
- For copy creation tasks, added the opportunity to save some settings as defaults for future tasks (with the button on the first tab in the settings dialog)
- Implemented the 'open with' method for files in the explorer view;
- Fixed the error occurring in clearing the original task map during data export from the object map and explorer views and to another drive connected to the standard system ports
- Fixed the looping error encountered during backward copying of chains containing sectors with problems at the chain border and with the block size of 1 sector
- FAT file system:
- ReiserFS: accelerated generation of file maps
- HFS+ file system:
- NTFS:
- UFS1 (2) file system:
- XFS: enhanced the 'Partition analysis' mode, accelerated generation of the partition map
- EXT2, 3, 4: enhanced the 'Partition analysis' mode, accelerated generation of the partition map
- The report on marked items is now saved in the task directory under a unique name including the date and time
- The name of the file being copied at the moment is now displayed on the explorer pane
- Revised power control in the DE task manager window and the task window
- Added the opportunity to include system SSD to the list of read only devices, which cannot be used as destination for copies
- Added in the raw recovery mode the opportunity to create virtual partitions of the following file systems: NTFS, FAT, ExtX, UFS1, UFS2, XFS, ExFAT, and HFS+. It is accessible from the context menu for the following file types: BootNTFS, FAT Folder, TableF16, TableF32, UFS1 SB, UFS2 SB, XFS SB, BootExFAT, and HFS. Partition beginning and size are detected automatically
- Added for all file systems (including virtual) the opportunity to control the header validity of files and (nonresident) directories. Red color indicates guaranteed invalid items, green - guaranteed valid ones
- Raw recovery mode:
- Quick disk analysis:
- Supplemented the settings with the functionality to enable/disable of caching management while writing to image files
- Added automatic restriction of the copy file size if the drive sector size is larger than 512 bytes
- Increased the timeout for asynchronous recording to image files
- Added on the map tab the 'pause' button that allows disabling automatic map synchronization while copying is in progress
- Revised the map scrolling implementation
- based on a map;
- based on the files selected in the explorer view.
- Revised the map generation mechanism for files with nonresident attribute $20 in cases when a part of the attribute is "lost". The map is now built to include information up to the attribute corruption
- Added the opportunity to generate a submap for drive heads without combining the chains from different heads
- Raw recovery mode, added detection of RAW formats of digital cameras earlier recognized as TIFF
- Implemented scanning method for FDC (file descriptor cluster) files
- Implemented the method for generation of the used/unused space maps
- Added support for the storage method for files smaller than 1 Kb in VMFS5
- Enhanced the new partition analysis method with the option to read tables in case of copy creation, and optimized the method of initial parsing for revealed tables
- Enhanced the partition analysis method with the option to consider InodeBitmap during the procedure. The method has been deeply optimized resulting in significantly accelerated performance
- Added the option to 'Show deleted objects' for the native file system
- Considerably increased performance due to multithreaded execution and optimization of preliminary analysis
- Added search and parsing of VMFS structures and directories
- Added method for creation of a virtual VMFS partition initiated on the basis of appropriate structures
- Added analysis of ReiserFS tree blocks
- Considerably increased performance due to multithreaded execution
- Added opportunity to cancel the procedure
- Fixed the error (presumably) preventing some users from activating the mode all the time or part of the time
- In the 'Partition analysis' and 'Search NTFS structures' modes the 'linking' mechanism based on extend information has been modified. Previous implementation could run out of RAM in some very rare cases
- Introduced some changes in the procedure saving compressed files, now an incorrectly unpacked block is filled with $00, but saving is not interrupted. The program adds a corresponding record to the error log
- Fixed the error introduced in the latest beta version causing incorrect generation of a map for a compressed file (although actual saving was performed correctly)
- Added Volume output for NTFS partitions
- Added the $Bitmap file map menu item
- Fixed the error in the map generation procedure for some files within large partitions (discovered in a partition of 12Tb)
- Changed the mechanism parsing multiple $30 attributes in the MFT scanning mode. Previous variation used to leave just one out of several links pointing to directories
- Considerably accelerated the first stage (search for structures) in the Partition analysis mode used with NTFS partitions
- Removed excessive output of the string containing the compressed file name to log
- Implemented an optional opportunity to take into account 'block group flags' while generating the maps of used/unused space, metadata map, and partition data analysis
- Revised directory parsing due to the existence of certain operating system versions with noncompliant Inode flags and directory storage forms
- Fixed the problem causing interruption of directory parsing within a native file system in case of certain errors in the structure of its metadata
- Fixed the error in parsing of dx_ directories consisting of multiple extends
- Fixed the error in the parsing implementation for 48-bit addresses. It was revealed on a 64 Tb partition
- Enhanced addition of a virtual partition during quick drive analysis and raw recovery (making it smarter)
- Fixed the error in size detection for the virtual partition being added
- Added the 'Partition analysis' method
- Implemented hash (MD5, SHA1) calculations for a chain within a map and an entire map, and also for a file in explorer view
- Implemented the functionality that allows exporting the lists of directories and files to a CSV with an opportunity to define the data set, calculate checksums (MD5, SHA1) and control the presence of unread sectors or sectors read with errors
- New implementation of the 'Partition analysis', 'Scan unused space', and 'Search NTFS structures' modes)
- Fixed the error in the MFT record editor occurring with partitions larger than 2 Tb
- Fixed the error causing incorrect generation of the used/unused space maps for partitions produced as a result of MFT scan
- New implementation of scan methods (CatalogFile, partition, used/unused space within a partition)
- Added hardlink support (with hardlink copying and opening of the source file)
- Fixed the error in support functionality for additional extends Fixed the error in Apple Partition Map interpretation for sector sizes other than 512 bytes
- Fixed the error occurring during generation of the used space map for drives using sector size larger than 512 bytes
- Fixed the error occurring during addition of a large virtual partition in the disk analysis mode (incorrect partition size setting)
- Long names without integrity control are now used for deleted files and folders (previously short names were used)
- Fixed the error in generation of the used/unused space maps for a partition (the last chain was ignored)
- Generation of the used/unused space maps has been enhanced with the ability to take into account Bitmap sectors, which could not be read or have been read with errors
- Revised the procedure of block number validity control in parsing of file system metadata
- Added the opportunity to group file/structure types by categories
- Fixed the error occurring while adding a record to the general raw recovery reference
- Defined more precisely the criteria used to check some file types
- Fixed the error in detection of the checked TIFF file size
- Fixed the error occurring while importing the general raw recovery reference
- Added in the raw recovery reference the opportunity to export/import its content to/from an external file
- Added an opportunity to export the raw recovery results to a CSV file
- Added the functionality to take into account read errors while building a bitmap-based map of used/unused space
- For addition of virtual partition from the raw recovery results, added the functionality to take into account the copy of group descriptors table, which allows to recover data in case of erased or corrupted first superblock and the table of group descriptors
- Added integrity control for the FAT sectors being analyzed
- Added one-time automatic start of the 'Partition analysis' mode if the root directory is empty
- Improved generation of the map for selected files based on the root directory
- Significantly accelerated generation of files map for a virtual partition produced as a result after scanning
- Significantly optimized and accelerated processing of results obtained after Catalog file scanning
- Significantly optimized and accelerated operations with the native file system including opening of directories, search and generation of maps
- Changed the Volume Header viewing window
- Optimized and revised the 'Search NTFS structures' and 'Partition analysis' modes
- The map of a nonresident directory now includes parts marked as unused in the attribute (B0)
- 'Partition analysis' mode now includes a request for a complete rescan
- Added the 'Partition analysis' mode
- Revised the superblock viewing windows
- Accelerated generation of the partition map
- Added search for the service structures of the following file systems: exFAT, HFS+, XFS, ExtX, UFS1/UFS2, ReiserFS
- Added search for NTFS nonresident indices
- Optimized performance and memory consumption
- Enabled support for the following file systems: UFS1/UFS2, ReiserFS, XFS, HFS+, EXT2, 3, 4
- Implemented creation of FAT16 and FAT32 virtual partitions in cases of missing Boot sectors and/or FAT
- Implemented correct addition of XFS, EXT2, 3, 4, UFS1/UFS2 virtual partitions in case if the first superblock is corrupted
- Added one-time automatic start of the procedure if the MBR, GPT, APM is missing or corrupted
