FORENSIC RECOVERY ANALYSIS ADVANCED

Disk / Image Forensics

Read the real partition tables, filesystem headers, and NTFS MFT inside a raw disk image — map damage, find deleted-entry candidates, and carve known file signatures.

READ-ONLY ANALYSIS — this tool never writes to, mounts, or modifies the image you give it.

Disk image

Original image is never modified · 100% local — nothing is uploaded, no matter how large

Common error messages this diagnoses

If you're here because something threw one of these, this tool shows you exactly what's wrong and how much is recoverable:

  • "The disk image file is corrupted" — generic mount-tool failure — this tool walks the real MBR/GPT tables to show what's actually wrong.
  • "Invalid partition table" — the MBR/GPT structure itself doesn't check out.
  • "This disk needs to be repaired" — (Windows) — often shown for a damaged partition table, not actual disk hardware failure.

What this tool doesn't do (yet)

Raw sector dumps only (.img/.raw/.dd/.bin/.iso) — no E01/EWF/Ex01/AFF/AFF4 forensic containers and no VHD/VHDX/VMDK/VDI/QCOW/QCOW2 virtual disks yet (all real future formats, none built), and no split-image sets (E01 segments or .001/.002 raw splits). No logical/extended-MBR partition-chain walking. No directory-tree browsing for any filesystem — that needs the NTFS index B-tree or FAT/ext directory walking, neither built yet, so NTFS is the only filesystem with deleted-entry-candidate detection here; FAT/exFAT/ext/ISO9660 get real boot-sector or superblock field parsing but no directory listing beyond ISO9660's root, and APFS/HFS+/XFS/Btrfs/ReFS get signature identification only. No structured (format-aware) file carving — the carving scanner matches magic bytes only and routes you to the right specialized tool for real structural validation. No fragmented-file reconstruction, no timeline view, no case notes/bookmarks, no whole-image hashing, no slack-space analysis, and no claims about hidden hardware areas (HPA/DCO) from a plain image. This tool never attempts to bypass encryption — encrypted volumes are only ever flagged as detected, never opened.