Welcome to : Forensic Data Recovery

Professional Modules add a powerful capability to this product.  Blade® is also ideal for practitioners (or technicians with limited forensic training) who want to perform quick and easy data recovery without resorting to using scripting programming languages or tying up their main forensic tool.

Hiberfil.sys Conversion

This professional module processes a Windows hibernation (hiberfil.sys) file and converts it into a raw memory dump output file that can then be used for subsequent searching by Blade®. A hibernation file contains blocks of data compressed using the Xpress Compression algorithm as documented on MSDN. The converter module decompresses these xpress blocks and writes out the pages of memory they contain, all assembled back into their correct page slots in the output file. The resulting output file is therefore an ordered dump of the pages of memory that were in use when the source computer entered hibernation.

The module supports hibernation files from Windows XP, Vista and 7, both 32-bit and 64-bit.

Advanced Forensics Format (AFF) Support and AFF Image Converter

The Advanced Forensics Format (AFF) is an extensible open format for the storage of disk images and related forensic metadata. It was developed by Simson Garfinkel and Basis Technology. Blade® (and HstEx®) now support the processing of AFF image files (as well as other forensic formats). The following page lists the supported file formats: Forensic Image Formats Supported by Blade®.

We have added a new Professional Module to allow you to convert AFF images to a single (or multiple) segment binary image. As you can see from the Image Converter properties (accessible by right clicking on the 'AFF Image Converter' and selecting 'Module Properties'), there are options for splitting the image and creating a specific segment length as well as calculating MD5 and SHA1 hashes on the output data.

SQLite Database Recovery

With the addition of the length multiplier option in the recovery profile, we have added a recovery profile which utilises this feature. The main database file consists of one or more pages. The size of a page is a power of two between 512 and 65536 inclusive. All pages within the same database are the same size. The page size for a database file is determined by the 2-byte integer located in the header of the file. Also located in the header is a 4-byte integer recording the size of the database file in pages. The multiplier feature can read this value and work out the correct size of the database.

New Evaluation Version of Blade® Professional

In this release of Blade®, we have added the ability to work in demo or evaluation mode.

For a period of 30 days from installation, Blade® will function with many of the features of the Professional version (with some limitations). During this time, Blade® will be able to process any of the supported data sources, but will only recover the first 10 of any identified file type. For a full list of the limitations, please see: Evaluation Version Limitations.

Video Library: Introduction to Blade® and the Data Recovery Features

To help you understand how Blade® works and to demonstrate the power of the software we have created a number of demonstration videos and presentations.  In the video library,  you will find a number of introductory screen-capture videos demonstrating the powerful capabilities of Blade®.

The videos will show you the user interface and explain some of the main features.  They will show access to the Global and Personal signature database where the forensic examiner can create and tweak data recovery profiles.

There is also an introduction to each Blade® Professional Module with a demonstration of how each one works.  The professional modules are the key to the power of this software.