What is DataDump™
DataDump™ is a free tool which allows you to dump segments of data, or all of the data, from an original source image or physical/logical device. It can be used for the following:
- Extract a stream of binary data from a source image or physical/logical device
- Convert an entire image or a segment of an image to a single flat file
- Extract binary chunks of data from files, images or physical/logical devices
- Extract a partition from a source device as a single binary file
- Hash the output data using MD5, SHA-1, SHA-256 or SHA-512
It is particularly useful when testing when you may wish to extract a small subset of data from the original source. All you have to do is select a source, select the start and end offsets, or start offset and length; then select a file to save the data to. During the extraction, the hex viewer display will change to show the data that is being dumped. Selecting an offset will also show the data located at that sector.
Dumping an SD Card
A common data recovery use case may be to capture all of the data from a removable device like an SD Card. This is easily achieved with DataDump ™.
- Run DataDump ™ and click on the Select Source button.
- Select Physical or Logical Device to launch the selection window:
3. Select the Drive Number which relates to your physical device. In our case above, the device we are interested in is Drive Number 8.
4. Click OK.
5. DO NOT change the Start or End LBA values. We automatically set the Start and End values to recover the full device.
6. Click Output File and select the destination file for your image.
Make sure you select an Output File on a device which is NOT the source. Also, ensure that the destination location has enough space to receive the data from your source. Make sure the destination is formatted to NTFS.
7. Once the Source and Output File have been selected, click on the Extract button. The will copy all of the data from your source into a single image file.
Extracting a Subset of Data
To extract a subset of data is a simple process. Identify the start of the data and the number of blocks you wish to extract. This can be done via the Start and End LBA Spin Edit boxes, or the Track Bar to the right of each Spin Edit box.
The start and end values use Logical Block Addressing. You will need to manually adjust any absolute byte offsets to LBA for the correct start offset to be selected. You can use the following formula:
LBA = byte offset / block size
It is important to note that LBA is a whole number, so any remainder resulting from the division should be truncated or rounded down to the nearest whole number. In addition, the first LBA on a storage device is typically 0, not 1, so the LBA of the first block is always 0. Typically, with an image from a hard disk, the block size would by 512 bytes.
You can then select the End LBA or the Block Count to set the number of bytes to be extracted.