1. 6. Fast navigation points
2. 7. Filling selection with a pattern
3. 8. Unicode support
4. 9. Quick Disk Info
5. 10. Bookmarks

1. 11. Data Inspector
2. 12. Search
3. 13. Working with images
4. 14. Hiperlinks in templates

1. Enhanced template view

Template view shows parsed records of the most important areas on disk, allowing easily interpretation and editing. When you navigate to a point of interest, a proper template is selected automatically. The following templates are supported: MBR, GUID Partition table, NTFS boot sector, NTFS MFT file record, FAT boot sector, FAT32 boot sector, FAT directory entry, exFAT boot sector, exFAT directory entry, HFS+ Volume header, HFS+ Catalog Node, HFS+ File Record, Ext2/Ext3/Ext4 superblock, Ext2/Ext3/Ext4 inode, UFS superblock, UFS inode, LDM structures.

As you edit data in Hex, ASCII or Unicode pane or in Templates window, modified data is fully synchronized between views. After each modification a template view is recalculated giving you an up-to-date interpretation of data.

MFT file record template shows data at a high level of details using multiple levels. You can examine a standard header, all attributes and attribute data of the record. The attributes interpreted are: $STANDARD_INFORMATION, $ATTRIBUTE_LIST, $FILE_NAME, $OBJECT_ID, $SECURITY_DESCRIPTOR, $VOLUME_NAME, $VOLUME_INFORMATION, $DATA, $INDEX_ROOT, $INDEX_ALLOCATION, $BITMAP, $REPARSE_POINT, $EA_INFORMATION, $EA, $LOGGED_UTILITY_STREAM.

3. Side-by-side Compare and Edit

Some records like boot sectors have their copies. Templates view automatically detects records supporting copies and shows both main and copy values allowing to compare them. You can arbitrary set an offset of main record and its copy.

Individual template fields are colored in hexadecimal pane giving a quick overview of all data. As you travel along fields in Templates window, the current field is highlighted in Hex pane. Hover mouse over a colored field to get a tooltip with additional information.

5. Extensive exFAT support

exFAT boot sector as well as all types of exFAT directory entries are supported giving you a detailed information on different exFAT structures. Move template offset up/down feature allows easily navigate between records.

6. Fast navigation points

You don't need to guess what is the sector of root directory on FAT volume is or where is $MFT record on NTFS partition located. Simply use fast navigation points set up in the menu. When Disk Editor opens an object, the most important areas are detected and automatically added to the list. They include boot sectors, FAT tables, root directory, $MFT and $MFT Mirror and others.

7. Filling selection with a pattern

It might be handy to fill an area on the disk with particular data. Besides simply zeroing an area by providing 00 as hexadecimal value you can specify any hexadecimal or text pattern for better flexibility.

8. Unicode support

Work with hexadecimal, ASCII or Unicode representation of data. Editing data in Unicode pane allows to enter extended characters directly while ASCII and Hexadecimal panes gives you control over individual bytes.

9. Quick Disk Info

Properties window gives a concise overview of disk or partition opened in Disk Editor. If unwanted this information can be hidden to save screen space.

10. Bookmarks

When analyzing large amounts of data don't get lost when navigating between different points. Easily bookmark locations by keyboard shortcuts and cycle through them. If you need even more flexibility, you can give any bookmark a name and navigate between them using a bookmark window.

11. Inspector

As you move a cursor along, data under cursor is automatically interpreted and shown in Data Inspector in different formats. You can see them as one to four byte numbers as well as time and other useful structures.

12. Search

Search data by ANSI, Hex or Unicode pattern. To speed up the process you can ask to search only at given offset inside used-defined blocks. Regular expressions and wildcard are even greater expand search capabilities.

Examples of using regular expressions:
^dd?$ - match integers 0 to 99
^S+$ - match strings without white space
b(mail|letter|correspondence)b - match strings containing 'mail' or 'letter' or 'correspondence' but only match whole words i.e. not 'email'.

13. Working with images

Open raw image created by Active@ Undelete or other Active@ products and investigate it with Disk Editor.

Third party disk image files such as Virtual PC Disk Image (*.vhd) or VMware Disk Image (*.vmdk) are also supported.

14. Hyperlinks in templates

Many templates contain hyperlinks allowing to easily navigate to important data points.

For example, MFT records contain links to first cluster in data runs and MBR provides links to partitions.

1. 6. Fast navigation points
2. 7. Filling selection with a pattern
3. 8. Unicode support
4. 9. Quick Disk Info
5. 10. Bookmarks

1. 11. Data Inspector
2. 12. Search
3. 13. Working with images
4. 14. Hiperlinks in templates

1. Enhanced template view

Template view shows parsed records of the most important areas on disk, allowing easily interpretation and editing. When you navigate to a point of interest, a proper template is selected automatically. The following templates are supported: MBR, GUID Partition table, NTFS boot sector, NTFS MFT file record, FAT boot sector, FAT32 boot sector, FAT directory entry, exFAT boot sector, exFAT directory entry, HFS+ Volume header, HFS+ Catalog Node, HFS+ File Record, Ext2/Ext3/Ext4 superblock, Ext2/Ext3/Ext4 inode, UFS superblock, UFS inode, LDM structures.

As you edit data in Hex, ASCII or Unicode pane or in Templates window, modified data is fully synchronized between views. After each modification a template view is recalculated giving you an up-to-date interpretation of data.

MFT file record template shows data at a high level of details using multiple levels. You can examine a standard header, all attributes and attribute data of the record. The attributes interpreted are: $STANDARD_INFORMATION, $ATTRIBUTE_LIST, $FILE_NAME, $OBJECT_ID, $SECURITY_DESCRIPTOR, $VOLUME_NAME, $VOLUME_INFORMATION, $DATA, $INDEX_ROOT, $INDEX_ALLOCATION, $BITMAP, $REPARSE_POINT, $EA_INFORMATION, $EA, $LOGGED_UTILITY_STREAM.

3. Side-by-side Compare and Edit

Some records like boot sectors have their copies. Templates view automatically detects records supporting copies and shows both main and copy values allowing to compare them. You can arbitrary set an offset of main record and its copy.

Individual template fields are colored in hexadecimal pane giving a quick overview of all data. As you travel along fields in Templates window, the current field is highlighted in Hex pane. Hover mouse over a colored field to get a tooltip with additional information.

5. Extensive exFAT support

exFAT boot sector as well as all types of exFAT directory entries are supported giving you a detailed information on different exFAT structures. Move template offset up/down feature allows easily navigate between records.

6. Fast navigation points

You don't need to guess what is the sector of root directory on FAT volume is or where is $MFT record on NTFS partition located. Simply use fast navigation points set up in the menu. When Disk Editor opens an object, the most important areas are detected and automatically added to the list. They include boot sectors, FAT tables, root directory, $MFT and $MFT Mirror and others.

7. Filling selection with a pattern

It might be handy to fill an area on the disk with particular data. Besides simply zeroing an area by providing 00 as hexadecimal value you can specify any hexadecimal or text pattern for better flexibility.

8. Unicode support

Work with hexadecimal, ASCII or Unicode representation of data. Editing data in Unicode pane allows to enter extended characters directly while ASCII and Hexadecimal panes gives you control over individual bytes.

9. Quick Disk Info

Properties window gives a concise overview of disk or partition opened in Disk Editor. If unwanted this information can be hidden to save screen space.

10. Bookmarks

When analyzing large amounts of data don't get lost when navigating between different points. Easily bookmark locations by keyboard shortcuts and cycle through them. If you need even more flexibility, you can give any bookmark a name and navigate between them using a bookmark window.

11. Inspector

As you move a cursor along, data under cursor is automatically interpreted and shown in Data Inspector in different formats. You can see them as one to four byte numbers as well as time and other useful structures.

12. Search

Search data by ANSI, Hex or Unicode pattern. To speed up the process you can ask to search only at given offset inside used-defined blocks. Regular expressions and wildcard are even greater expand search capabilities.

Examples of using regular expressions:
^dd?$ - match integers 0 to 99
^S+$ - match strings without white space
b(mail|letter|correspondence)b - match strings containing 'mail' or 'letter' or 'correspondence' but only match whole words i.e. not 'email'.

13. Working with images

Open raw image created by Active@ Undelete or other Active@ products and investigate it with Disk Editor.

Third party disk image files such as Virtual PC Disk Image (*.vhd) or VMware Disk Image (*.vmdk) are also supported.

14. Hyperlinks in templates

Many templates contain hyperlinks allowing to easily navigate to important data points.

For example, MFT records contain links to first cluster in data runs and MBR provides links to partitions.