Runtime's Disk Digger lets you inspect and navigate any file system or on-disk structure. It displays details in an Internet Explorer window. Views are driven by scripts and an integrated script interpreter. The customizable scripts determine what and how information is displayed. The script language is Pascal, so everybody with knowledge of a higher programming language will be able to modify or create new scripts.
This version of Disk Digger comes with over 20 ready-to-use scripts for the following file systems:
The scripts show all relevant data structures, such as partition tables, boot records, and file system-specific structures. The sophistication of those script goes to the point of you being able to retrieve individual files from the supported file systems. Disk Digger includes all the script's source codes. The script editor allows you to make changes to your code and test it immediately quickly.
At Runtime Software, we use Disk Digger to reverse-engineer file systems and program new features for our data recovery software. You can employ Disk Digger for research or forensic investigations when exploring unknown hard drives.
The provided Disk Digger scripts show you how to extract files programmatically from NTFS, FAT, EXT, and XFS. You can use these scripts as a blueprint for customized data recoveries or forensic investigations.
With advanced programming skills, you can write additional scripts for other file systems or container structures such as backup files, virtualization volumes, encrypted volumes, or surveillance disks. A rich set of built-in commands lets you access and process disks and images files. You could even develop your own data recovery software based on those scripts.
If a standard recovery software, such as GetDataBack, is not sufficient to accomplish your objective, Disk Digger is the perfect tool.
You can create report scripts for data recovery or forensic purposes that no other software offers.
Disk Digger consists of two distinct functions,
The Explorer address bar tells the program the drive, sector, and View to be displayed. For example, the address
http://local/mft/HD128:/7088128
tells Disk Digger to display the content of sector 7088128
on the first physical drive (HD128:
) using the script mft.src
.
The script editor contains a powerful debugger. You can trace through your script, inspect its flow and variables.
Scripts usually contain many links allowing the user to navigate through the file system as she would navigate a Web site.
The usage of Internet Explorer enables you to print your windows effortlessly. You can also save the current View or all visited Views into HTML documents. This facilitates documentation of, for example, forensic jobs.