Content

Stellar Phoenix FAT & NTFS

Stellar Phoenix is a product aimed at data recovery, rather than strict forensics, although of course recovery is an important part of incident response. Confronted with a disk with damaged or missing data, the software will attempt to recover information and reconstruct partial data.

Like several other products in this space, Stellar Phoenix requires a security dongle (in this case, an Aladdin HASP device) before it will run. In addition, the local user must have at least power user privileges, preventing normal users from using the software to access files they should not.

Phoenix is very simple to use, with a familiar Windows file-explorer type interface. The first step is to identify a target drive, partition or logical drive (the software will scan drives for partition information).

The system only works on physically connected devices, not on disk images, which is a shame. But given its primary purpose is a data recovery tool not a forensic product, this was not unexpected.

Once a target drive is identified, Phoenix scans the drive for files and folders, including fragments outside the file allocation tables, lost partitions, and data on formatted drives. It does this very quickly, although it might take a lot longer on a seriously damaged drive, particularly if there is any physical damage.

With the tree of data ready to go, files and folders are marked for recovery by ticking a check box in the tree view.

One click of the mouse, and recovery begins, with a prompt for where to store the data on the system's home filesystem. With our sample data, this was very quick, even with hefty chunks of information to restore.

There are some limitations to the product which count against it. Only Windows file systems can be examined (Stellar has separate products for other file systems), and file searching is primitive.

In addition, with only limited auditing and no hashing at all, we would suggest that you use this in conjunction with another forensic file recovery tool. But we really like the clean interface and quick performance of the software.

As a product with a specific task to accomplish, Stellar Phoenix does the job very well.

Product title
Stellar Phoenix FAT & NTFS
Product info
Name: Stellar Phoenix FAT & NTFS (Group Test: Forensic tools) Description: Price: $129
Strength
Fast, simple and effective: does exactly what it says.
Weakness
No support for non-Windows file systems, limited searching.
Verdict
Quick and powerful tool for recovering lost Windows data.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.