Page tree
Skip to end of metadata
Go to start of metadata

Overview

Blade has been designed to process a forensic image, physical/logical disk or binary dump at sector level.  It does not work at the file system level.  When Blade searches your source, it will search it a sector (or number of sectors depending on the block size set) at a time.  Blade uses linear processing and will examine each block of data contiguously. This means that it will potentially recover data from (but not limited to) the following areas:
  • Unallocated clusters
  • Unused disk space
  • Cluster slack
  • Volume slack
  • Reserved disk areas
  • Swap files
  • Binary dump files
  • Hibernation files
  • Deleted Files
  • Resident Files
  • Shadow Volumes
  • Restore Points

It works in a similar way to an imager in that it starts at sector zero and processes all the data to the end.

As Blade does not need a file system to be present, it can be run across many source file system types without issue.  It also means that when it recovers from a disk or image, it will potentially recover the live data as well as any that is deleted.

Limitations of Linear Processing

What Blade will not do is recover data which traverses a cluster boundary on non-contiguous clusters.

Further Information