Blade has been designed to process a forensic image, physical/logical disk or binary dump at sector level. It does not work at the file system level. When Blade searches your source, it will search it a sector (or number of sectors depending on the block size set) at a time. Blade uses linear processing and will examine each block of data contiguously. This means that it will potentially recover data from (but not limited to) the following areas: |
It works in a similar way to an imager in that it starts at sector zero and processes all the data to the end.
As Blade does not need a file system to be present, it can be run across many source file system types without issue. It also means that when it recovers from a disk or image, it will potentially recover the live data as well as any that is deleted.
What Blade will not do is recover data which traverses a cluster boundary on non-contiguous clusters.