Serious bug in Data Extractor

[ketil]

Hi,

I have a case in Data Extractor that I was working on. Suddenly, my data was wrong in data extractor, because it showed that sectors were filled with all zeros when I knew there was data there. I opened the first sector (sector 0), and all 512 bytes were 0x00, but I knew that this was not the case. After a lot of checking, I tried running SysInternals procmon while opening my case in data extractor. When Data Extractor tried to open image file img000000000.bin, it got a SHARING VIOLATION error, so the file was not opened successfully. However, Data Extractor did not give me any alert or warning, it just filled all zero values and showed me that as if nothing had happened, for all LBA belonging to that file. If I opened some other file later in the image, I got SUCCESS and the correct data was shown. Fortunately I spotted this, and could resolve the problem.

The problem was caused because I had opened the image files in EnCase as well. It turns out that in my case, EnCase is better at parsing partially missing MFT, and I could reconstruct files that Data Extractor couldn't find when the MFT for the folder was missing. EnCase managed to find (at least partial) MFT data somewhere else, and used that to successfully recover the files. I had opened the bin files directly in EnCase (using File -> Add Raw Image...), and that caused the Sharing Violation. Next time I'll emulate a local disk and open that with EnCase, but this is still a serious bug in Data Extractor that can silently ruin data recovery. The issue was resolved by closing EnCase, and then Data Extractor immediately showed me correct data.

Please fix this bug by checking for errors in Data Extractor when it opens image files.

I was using Data Extractor 5.0.0.3050 and PC-3000 Express 5.5.14.3099.

Regards, Ketil