Data Sources in HstEx— HstEx® supports a number of different source image formats and data types. It has native support for e01 and ex01 files as well as the ability to directly read hard disks and media and sector level.
Page:
Dumping Data from an Image or Disk— When debugging or testing a digital forensic tool, or performing a data recovery procedure, you may have a requirement to extract some binary data from a forensic image or physical/logical disk. This is where DataDump can be of value.
Page:
File Extensions— When you create and save a recovery session in HstEx®, a session database file is created with an *.hx4s extension. As recovery jobs are added to the session, they will be saved to this database. At a later date, the session database can be re-opened in HstEx® and re-run if required. The session database will also remember the state of each job, so if a session is cancelled before it has been completed, HstEx® can continue processing each outstanding job. The image below shows a folder containing a number of session databases.
Page:
Recovery Job— A recovery job contains all the parameters for recovering data against a single source. A powerful feature of HstEx® is the ability to select multiple recovery modules to run against a source, as well as being able to configure multiple-jobs to run against different sources.
Page:
Session File— HstEx® allows the user to create a session and then add multiple recovery jobs as required. Each recovery job has a single data source and allows the user to select as many recovery types as required.
Page:
Supported Browsers— We have added support for the latest browsers. This is the current list of supported browsers and artefacts in HstEx:
