1. Disk Structure: MBR → Filesystem → Directories → Inodes → Data Blocks
This view shows a simplified disk layout. At the beginning of the disk you see the partition/boot area, then the filesystem metadata, inode table, directory blocks, and finally blocks that hold actual file content. Click through the animation to follow how a path like /home/user/photo.jpg is resolved.
2. File Carving: Scan Raw Blocks for File Signatures
This animation shows a deleted JPEG whose directory entry is gone. The recovery tool ignores the broken filesystem links and scans raw blocks directly. It moves block-by-block until it sees a known header. For JPEG, the common start marker is FFD8 and the footer is FFD9.
Current logic
3. Live Forensics: Evidence from a Running System
Live forensics focuses on evidence that may disappear if the machine powers off. The animation below walks through memory capture, running process collection, network connection capture, and volatile artefact preservation.
System is live. Volatile evidence still exists.
Acquire memory image before shutdown.
Collect running tasks, DLLs, handles, command lines.
Open sockets, active sessions, ARP, routes.
Export evidence and continue offline analysis.
4. Disk Imaging: Bit-for-Bit Forensic Copy with Hash Verification
Forensic imaging copies every readable sector, including deleted areas and slack space, to preserve evidence exactly. The animation shows sectors being copied into an image file and then verified with a cryptographic hash.
Original disk sectors
Forensic image sectors
5. Data Reconstruction: Reassemble Fragmented Data
When a file is fragmented, its content may be stored non-contiguously. Reconstruction uses metadata when available, and otherwise relies on signatures, internal structure, offsets, size assumptions, and content continuity.
Fragments discovered on disk
Rebuilt order
6. Password Cracking: Educational Brute-Force Demonstration
This animation demonstrates the defensive concept of brute-force password guessing against a toy target. It is intentionally simplified and does not provide real cracking capability. It shows the cycle: generate guess → hash guess → compare to target hash → stop on match.