UFS Explorer Professional Recovery
Available for: Icon Windows Icon macOS Icon Linux

UFS Explorer Professional Recovery

For data recovery engineers and digital data investigators
from $629.95

  • Wide range of configurable automatic data analysis algorithms
  • Multi-pass disk imager with advanced processing of read defects
  • Full support of digital evidence formats (forensic disk images)
  • Support of a number of file level and full disk encryption technologies
  • Large number of supported file system types
  • Automatic recognition of metadata of hardware and software RAID
  • Adjustable RAID builder with an embedded script handler
  • Diverse means for effective analysis, reporting and recovery of data
  • Free trial with no time limit is available

  • Disk imager
  • RAID
  • SAN
  • NAS
  • iSCSI
  • QNAP
  • Synology
  • WD
  • Drobo
  • BitLocker
  • FileVault
  • LUKS
  • eCryptFS
  • TrueCrypt
  • VeraCrypt
  • JMS561
  • ATA
  • RAID-Z
  • LVM
  • Thin Provisioning
  • BeondRAID
  • Storage Spaces
  • Reverse RAID
  • VMware
  • Hyper-V
  • VirtualBox
  • ZFS
  • F2FS
  • Btrfs
  • ReFS
  • VMFS
  • XFS
  • EnCase
  • E01
  • AFF4
  • Hash

Overview

UFS Explorer Professional Recovery software includes a complete professional toolkit for all stages of data analysis and recovery.

When starting work with the original data, the program will allow you to create a disk image. To protect the data from damage by running the OS or third-party software, the program supports hardware write blockers made by various vendors. Creating an image in several passes ensures maximum performance and accuracy of creating an image even from disks with defective blocks. It is also supported the creation of disk images in forensic format with full data integrity control. And all this is available without restrictions even during the software evaluation!

If you already have image files - that's even better. The program supports a large number of disk image file formats - from simple image files without metadata, to virtual disks of virtualization systems and data formats specific to digital evidence (EnCase, AFF4, etc.).

Most types of complex volumes made as RAID on several disks or created virtually from a data pool (Drobo, Microsoft Storage Spaces, LVM Thin and others) can be assembled by the program automatically. If the automatic procedure is turned off or metadata is damaged, such volumes can be assembled using special tools, developed to support these technologies: RAID Builder, Drobo BeyonRAID Assistant, Microsoft Storage Space volumes, and others.

If the data is encrypted, the program will be able to decrypt it by supporting a large number of popular encryption methods, including BitLocker, LUKS, Apple encryption and so on. Of course, this is only possible if you have the appropriate passwords or encryption keys.

Data on assembled volumes is available immediately, without lengthy analysis, exactly as it is read by the operating system. But if you need to recover lost data or data from a damaged volume, the program allows you to run a quick or deep scan to find lost data. Such an analysis has a sufficient number of settings for different needs. A quick scan can also be useful if you need to have a complete map of the location of all files on the volume at once.

Found data can be processed and sorted in the interface, supported file-level encryption can be decrypted and data can be copied to another medium. Moreover, data copying can be started both manually (file by file, directory by directory), and in automatic or batch modes. In any case, the program not only copies data, but also preserves file attributes.

If you only need to assemble a volume for processing by other software, this is also quite easy to do: the program allows you to mount the assembled volume in the OS as a virtual SCSI disk.

Technical specifications

Supported host operating systems:
(with the default installer)
Microsoft Windows ®: Windows ® 7 with Service Pack 1 and later
Apple macOS: version 10.15 and later
Linux: Most Linux distributions with X GUI and libstdc++.so.6 API level
Supported host computer architectures:
Intel Architecture, 32-bit (IA-32, x86)
AMD64 (x86-64)
ARM/ARM64 (Apple Silicon and other)
Supported file systems:
Data access and data analysis (scan):
Generic: FAT, FAT32, exFAT
Windows: NTFS, ReFS/ReFS3
macOS: HFS+, APFS
Linux: Ext2, Ext3, Ext4, XFS, XFS (XF), JFS, ReiserFS, Btrfs, F2FS
BSD, Solaris: UFS, UFS2, Adaptec UFS, big-endian UFS, ZFS
VMware: VMFS, VMFS6.
CCTV: HIK, WFS, DHFS, BKFL, MDFS, DVFE, MirageFS, RsfsFS, TangoFS, TPFS
Data access only:
CD/DVD/media: ISO9660/Joliet, UDF
macOS: HFS
Novell: NWFS, NSS, NSS64
Older Windows NT / OS/2: HPFS
Recovery from complex RAID storages:
Automatic recognition of known RAID metadata, saving and editing RAID configurations
Automatic reconstruction of mdadm, LVM, Apple Software RAID, LVM2, NT LDM, APFS Fusion, JMicron (JMS561 etc.), OpenBSD BIO RAID, Intel Matrix, DDF1 (LSI, Dell, Intel etc.), Silicon Image, DDF2 (Adaptec etc.) etc.
Support of most popular standard RAID patterns for RAID 0, RAID 1 (mirror), RAID 1E, RAID 3, RAID 5, RAID 6, RAID 7, RAID 50, RAID 60, spanned volumes etc.
RAID-on-RAID support: RAID level 10, 50, 60, 50E, etc.
Support of custom RAID patterns via RDL or Runtime VIM
Support of "stripe"-volumes with ZFS and RAID-Z (RAID-Z, RAID-Z2, RAID-Z3)
Adaptive reconstruction of RAID 5, RAID 6, RAID 5E, RAID 1, RAID 10, RAID 0+1 and nested RAID (levels 50, 51, 60, 61, etc.) using maps of bad sectors and in case of presence of defects (reading errors)
RAID assembly from virtual disks
Support of Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID, Microsoft Storage Spaces, LVM thin-provisioned volumes
SAN recovery (Dell EqualLogic, IBM StorWize etc.) with degraded RAID 5, RAID 10, etc. and up to double-degraded RAID 6, RAID 60; volume data recovery (using an external data map)
Supported encryption techniques:
Generic full-disk encryption
LUKS encryption (both LUKS and LUKS2)
Apple FileVault 2 encryption
Encryption of Apple APFS volumes
BitLocker and BitLocker To Go encryption
TruCrypt and VeraCrypt
OpenBSD BIO
Encrypted VMDK virtual disks
Encrypted macOS DMG and sparsebundle files
JMS561 bridge chip encryption (WD MyBook etc.)
Disks from older WD MyBook/MyPassport devices with Symwave SW6316, Initio 1607E, JMicron JMS538 and Oxford OXUF943SE bridge chips
File-level encryption (eCryptFS)
Supported virtual disk technologies:
VMware VMDK (including seSparse snapshots), Hyper-V VHD and VHDX (including AVHDX snapshots), QEMU/XEN QCOW/QCOW2, VirtualBox VDI, Apple DMG (including encrypted), Apple sparsebundle (including encrypted), Paralles HDD/HDS, EnCase E01 and Ex01 (non-encrypted), AFF4, simple disk images
Internal sparse format (SDLSP)
Support of 'volume' as a disk image (to support XEN LVM virtual disks and others)
Opening a partition/file within a storage as a virtual disk
Synology Sparse iSCSI
Custom "virtual image" files of Runtime Software
Work with disk images created by MRT data recovery tools (sorting and combining file image chunks into an image file)
DeepSpar DDI images (including split ones)
R-Studio image files (RDR file format)
With all virtual storage types: dynamic definition of virtual bad blocks on disk images using an external map, embedded map or by recognizing a given pattern
Supported technologies:
Automatic reconstruction:
Logical Disk Manager, Storage Spaces, Microsoft volume deduplication, Apple Core Storage, Apple Software RAID, LVM, mdadm, supported hardware and software RAID metadata.
Partition structure:
MBR, Apple Partition Map, BSD/Adaptec/Solaris/Unix Slice Map, GPT, Novel, RAID
Recognition and hinting for:
Providing a partition table, information about Spans and Stripes of AIX LVM, HP-UX LVM
Indication of Drobo volumes, HP EVA, HP LeftHand, Symphony SAN, HPE 3PAR etc.
Ways and means to work with damaged disks:
On-demand disk imaging: advanced reading of the required data with immediate transfer to the disk image. Re-reading only from the image.
Embedded multi-pass disk imager with settings for read method/timeout and parameters for skipping defects
Production of a defects map and a map of entropy (optional) during the imaging process
Advanced “Open storage” procedure with drive reading configuration and with possibility to pass the disk directly to the disk imager (with no partition or file system search)
Direct network access and processing of disks connected through DeepSpar Disk Imager, including imaging by a bitmap
Option of simple read-once disk access with saving of processed data
Asynchronous management of imaging tasks of UFS Explorer, DeepSpar DDI, or other supported asynchronous imaging solutions
Imaging of used space with the help of a file system map
Conversion of used file system space to a mask
Creating "dynamic" (pattern-based) maps of bad blocks for disk images, including possibility to save or cache such maps
Defining damaged regions using bad sector maps created by UFS Explorer or compatible third-party tools (ACE Lab solutions, DeepSpar DDI)
Interaction with MRT Data Explorer, including the support of task files and control over disk imaging performed by MRT data recovery tools (imaging by a bitmap, choosing specific ranges, files/folders, etc.)
Use of disk images instead of original disks (including ones from third-party software)
Supplementary features:
Tools for low-level data analysis:
Hexadecimal viewer for storages, partitions, files, file fragments
Hexadecimal editor for disks and partitions
Field highlighting
Data interpreter
Parity calculator
Storage content comparison
Bitwise "exclusive OR" (XOR) function
Parallel search
File allocation tracing through address translation
Tracing of files/folders metadata to volume addresses
Tracing of data to files through reverse address translation
View of file fragments with virtual offsets and sizes
Indication of used file system space
Additional functions related to storage scan:
Pausing the scan
Previewing intermediate scan results
Saving intermediate scan state information for future resumption
Saving scan results for further work
Full-range storage scan for all-at-once data recovery
Visualization of the scanning process
Five options for handling the existing file system
Options for work with partitions:
Automatic detection of lost partitions
Search for lost partitions
Defining partitions manually
Automated partition aligning
Reporting capabilities:
Interactive HTML report
Basic list of folders and files (HTML, CSV, XML)
Recoverable data size with metadata test
Software events log
Minimal configuration:
any of the supported operating systems
at least 30 MB of free space on the disk for the software executable files
at least 32 MB of free RAM
Linux software version can run from most modern Linux Live CD
Recommended configuration:
64-bit edition of any of the supported operating systems
over 30 MB of free space on the disk for the program and temporary files
16 GB of RAM and 4 logical cores CPU
default web browser
Trial limitations:
The software will copy files with the size below 768 KB.
Embedded iSCSI server is limited to volume size of 2 TB.
Some hexadecimal viewer dialogs have "Save" function disabled.

Key features

Work with various storage technologies Work with various storage technologies
This professional application provides effective means for processing a variety of storage technologies implemented in modern devices. Among them are Windows Dynamic Disks and Storage Spaces, Apple Software RAID, Core Storage and Time Machine, Linux mdadm, LVM with Thin Provisioning, Btrfs-RAID, ZFS RAID-Z, Drobo’s BeyondRAID, Synology’s Hybrid RAID and other specific configurations. The software also supports the technology of Microsoft data deduplication (Windows Server), enabling users to recover data lost from deduplicated NTFS and ReFS volumes.
Support of a wide range of file systems Support of a wide range of file systems
UFS Explorer Professional Recovery offers immediate access to the available content and allows restoring lost information from a comprehensive set of file systems applied in Windows (FAT/FAT32/exFAT, NTFS and ReFS/ReFS3), macOS (HFS+, APFS), Linux (Ext2, Ext3, Ext4, SGI XFS, JFS, ReiserFS, Sun ZFS, Btrfs, F2FS), BSD/Solaris (ZFS) and VMware (VMFS, VMFS6), along with the possibility to read volumes with the legacy Apple HFS and IBM/Microsoft HPFS file systems, Novell NetWare (NWFS) and Novell Storage Services (NWFS, NSS, NSS 64) file systems.
Data recovery from RAID Data recovery from RAID
The utility offers automatic assembly for various RAID setups, including non-redundant RAID level 0 and JBOD, 1 and 1E mirrors, levels 3 and 4 with dedicated and 5 and 6 with distributed parity as well as nested RAID layouts. A special syntax makes it possible to define custom RAID configurations with different data distribution algorithms. The program is also capable of performing adaptive reconstruction of a defective RAID using parity (for RAID 5 and RAID 6) or a copy of data (for RAID 1). A RAID set can be also reconstructed using disk images with the imitation of bad sectors with the help of bad sector maps.
Decryption of encrypted storges Decryption of encrypted storges
The software supports most common disk encryption technologies, including LUKS, BitLocker, FileVault 2, APFS encryption and eCryptFS, providing the possibility of access to the intact data and recovery of lost files from encrypted volumes in cases when the encryption key is known to the user. There is no need to run the operating system and unlock the drive – the password/key can be inserted directly in the software and it will use it to decipher the storage for further operations.
Support of modern virtualization technologies Support of modern virtualization technologies
UFS Explorer Professional Recovery allows working with virtual disks used by leading virtualization systems, including VMware, Hyper-V, VirtualBox, QEMU and XEN, as if they were ordinary physical devices, and makes it possible to open them or recover lost data even when they are stored on RAID or on another virtual machine. For example, the user can build RAID storing a VMware ESX virtual machine (VMFS file system), open a virtual disk directly from VMFS and recover data straight from the virtual machine without the need to extract the virtual disk first.
Advanced disk reading procedure Advanced disk reading procedure
UFS Explorer Professional Recovery allows choosing the method of data access and specifying an I/O timeout for cases when reading fails due to a device error. A “read-once” option makes it possible to avoid extra read requests to the same location on the disk and save the processed information to a sparse image file, reducing the load on unstable storages and preventing their further degradation.
Extensive disk imaging possibilities Extensive disk imaging possibilities
The software allows creating a full bit-to-bit copy of a storage or customizing the imaged area either by specifying ranges on the disk or by selecting a group of files to be cloned. The embedded disk imager also provides adjustable parameters such as read timeout, block size, direction, protocol and settings for the omission of defective blocks after unsuccessful reading attempts. The bad blocks encountered during the process get indicated in a map file while a log of reading errors can be saved as a report.
Defining damaged sectors Defining damaged sectors
UFS Explorer Professional Recovery produces defects maps during disk imaging and supports ones created by other compatible solutions. The program can utilize such a map for the virtual definition of damaged sectors on the storage or identify bad blocks dynamically by recognizing a specified content pattern. What is more, the software provides the possibility to create a mask with emulation of defects from the used or free file system space and employ this mask for disk imaging, scanning and other operations. The masked areas can also be filled with a given template.
Customizable scanning Customizable scanning
The software offers several scanning options, including a quick scan for defined file system types, longer profound search for lost data by known content with the possibility to provide custom IntelliRAW rules, scanning of the space used by the file system or just the “free space” areas. The scanning procedure can be paused for checking the intermediate result while its results can be saved for further references.
Sector size mutation Sector size mutation
While a typical sector size of a hard drive is 512 bytes, some vendors, like NetApp, EMC, HP, etc. use proprietary block formats in their storage systems which makes it impossible to access data on such disks without specialized hardware. UFS Explorer Professional supports SCSI and SAS drives with a non-standard sector size (520 bytes, 524 bytes, 528 bytes and others) and performs automatic sector conversion in the conventional size of 512 bytes through metadata truncation for subsequent data recovery or access to files.
Support of DeepSpar Disk Imager Support of DeepSpar Disk Imager
UFS Explorer Professional Recovery enables direct access via network and allows restoring files from damaged disks connected to a DeepSpar Disk Imager device with the possibility to adjust the read timeout, block size and other parameters for maximum safety and efficiency of the procedure. Moreover, the software supports disk images generated by DDI, including the “split” image format. The imaging can also be performed by DDI by a bitmap loaded into the program.
Interaction with MRT data recovery tools Interaction with MRT data recovery tools
The utility is compatible with MRT Data Explorer, supports task files created by this software along with defects maps associated with them and provides control over disk imaging carried out by MRT solutions, including the possibility to image by a bitmap, choose specific ranges, files/folders, etc. Also, the program allows loading file image chunks from an MRT task, sorts them automatically and fills them with the necessary spacers for further operations.
Comprehensive toolkit for data analysis Comprehensive toolkit for data analysis
UFS Explorer Professional Recovery offers all the necessary means for efficient work with the raw content of storages, partitions, files or their fragments in a hexadecimal mode. A convenient hexadecimal viewer with a raw data inspector, position bookmarks, structure templates, reverse data address translation, parallel search, data comparison and other features significantly facilitates data parsing while a hexadecimal editor with a set of auxiliary tools enables it easy manual modification.

When to use UFS Explorer Professional Recovery

screen
Get access to files or cope with data loss from common storage media: hard disk drives, USB sticks, memory cards, etc.

The utility effectively works with various linear storage devices, including internal as well as external hard disk drives, USB flash drives, memory cards and many others, thus serving as an essential data recovery tool for handling most typical cases of data loss, like accidental deletion of files, storage formatting, malware attack, hardware or software malfunction, etc.

screen
Recover data from complex storage systems: RAID and RAID-based devices

UFS Explorer Professional Recovery is an efficient solution for restoring data from RAID of different complexity, both software and hardware, and various RAID-based storages, like DAS, NAS and SAN. Moreover, the software makes it possible to perform data recovery from systems that apply specific RAID configurations, like Drobo BeyondRAID, Synology Hybrid RAID, Btrfs-RAID, ZFS RAID-Z, Dell EqualLogic and HP MSA with diagonal XOR.

screen
Work with devices implementing specific technologies: Apple Core Storage, LVM with thin provisioning, Storage Spaces, etc.

The software is enhanced with wide support of modern storage technologies employed in different environments. It allows processing composite volumes, including Apple Core Storage, LVM with thin provisioning, MS Storage Spaces and Dynamic Disks, deduplicated NTFS and ReFS partitions, SCSI/SAS-drives with non-standard sector sizes, etc. which significantly expands the list of target devices it can be applied to.

screen
Access or restore files from encrypted storages: LUKS, FileVault 2, BitLocker, APFS, etc.

The application is able to decrypt disk volumes for data recovery and data access purposes (if the encryption key is known). The list of supported methods includes LUKS, FileVault 2, BitLocker, encryption of Apple APFS volumes and eCryptFS.

screen
Retrieve files from defective disks

The application gives the possibility to recover data from storages that have damaged sectors or other hardware issues with maximum efficiency. Not only it offers highly configurable disk reading and imaging procedures, but also generates a map of bad blocks during the imaging process. In addition, virtual bad blocks can be defined dynamically on disk images by recognizing a given pattern or by reading bad sectors maps created by other compatible solutions. The software also allows converting the used or free file system space to a mask with emulation of defects and use it for imaging/scanning. Bitmap-based imaging via DeepSpar DDI is supported by the program as well.

screen
Open or recover data stored in virtual machines: VMware, Hyper-V, VirtualBox, etc.

UFS Explorer Professional Recovery effectively deals with disk images and virtual disks created by major virtualization software, like VMware, Microsoft Hyper-V, VirtualBox, QEMU, XEN, etc. and successfully copes with data recovery from such storages as though they were ordinary physical devices.

screen
Work with "disk-on-disk" storages of any hierarchy

The software is capable of imitating work of virtualization software and consequently provides access and restores files from multi-level virtual storages with no additional operations required. For example, the user can scan a virtual disk stored inside another virtual disk and promptly retrieve files that were lost or deleted from it.

screen
Reconstruct damaged file systems: Windows, macOS, Linux

A set of tools integrated in the software allow effectively solving practically any case of logical data loss, including the most severe ones. The program will either simply read file system metadata or conduct its detailed analysis and predict the allocation of files based on the file system specifics, allocation of other files or file content analysis to produce the best possible data recovery result.

Software Releases
The current version of the product can be obtained on the download page available via the button below.
  • Download links for all previous product versions starting from Version 7 (including Versions 7.*, 8.*, 9.*) and up to the current version are provided in the Changes log. There you will also see the record of updates and their descriptions.
  • Older Version 5.25.1 of the software can be downloaded from its product page in the Software Store.
  • Other discontinued versions (Version 3, Version 4.9.2 up to Version 5.9) can be found on the Legacy downloads page.

We appreciate your interest to UFS Explorer. Join us on social media to get regular updates about the software.