IsoBuster is intended to rescue files lost due to multiple causes, like accidental deletion, corrupted partition and virus attacks. The program supports practically any type of storage device, including optical discs, memory cards, USB drives and hard disks. Likewise, it can open an impressive list of image file extensions. It is good news that it supports not only Windows file systems (FAT and NTFS) but others as well.
The program does an excellent job of extracting contents from optical discs that are not in an optimum state. This includes playing audio from damaged analog CDs. Moreover, it has the advantage of supporting managed image files, which eliminates the necessity of extracting all the contents of a disc. The tool can also perform surface scans and mark defective blocks, which can later be filled manually.
All in all, IsoBuster provides an effective way to recover lost data irrespective of the original storage device and file system. In this respect, the program is more powerful than others. In my opinion, its main weakness is still its interface, which makes it inappropriate for inexperienced users. Moreover, I think that the tool would be complete if it allowed backing up partitions as ISO files, something that is possible with other data recoverers. The product is shareware and can be evaluated at no cost. However, some of its features are restricted, such as recovering files and viewing a sector.
v3.4 [Aug 23, 2014]
Changes:
- IsoBuster now also provides access to logical drives (C: D: etc.) instead of only Physical drives (see options). This gives access to Windows volumes. So on a higher level, which means that drivers can translate the data first before IsoBuster gets it. This is particularly useful in case of encrypted volumes, for instance TrueCrypt mounted volumes
- Dialog for experts with a [Professional] license to work with, test and complete managed image files
- Command line parameters /CI: /RANGE: /FROMTO: and /EP:NPC to complete a managed image file, inside a range or not
- Ability to create an empty IBP/IBQ file set (no actual reads executed) via /ET:E to allow investigators to complete regions via /CI: and /RANGE: or /FROMTO:
- Allow managed image files to be completed at the end with dummy data if the input drive is "*" (/D:*)
- Implemented ability to reverse read (during extraction), using a given range
- Ability to reverse read via command line parameter: /RR:[Interval]
- Detect if the Linux EXT(2-4) file system is present and show an icon for it (exploration of EXT itself is not implemented but now an investigator knows it's present)
- Detect if the Unix UFS(1-2) file system is present and show an icon for it (exploration of UFS itself is not implemented but now an investigator knows it's present)
- Detect if the Linux Reiser(1-4) file system is present and show an icon for it (exploration of Reiser itself is not implemented but now an investigator knows it's present)
- Detect if the Unix XFS(1-4) file system is present and show an icon for it (exploration of XFS itself is not implemented but now an investigator knows it's present)
- Ability to load an additional LibEWF.dll next to the already present, embedded, libewf-20130416 version. A libewf.dll and its dependables need to be put in the /plugins/ folder
- IsoBuster will now always first try to load the dynamic version (assumed to be more recent) before falling back on the embedded libewf-20130416 version. The embedded version may be removed over time to reduce the size again, we'll see
- New option that defines how strict surface scanning is and whether there should be an abort after an error
Improvements:
- Improved device naming if Inquiry fails
- Improved determination of HD vs USB stick/Flash etc.
- Improved user feedback while cleaning up (sanitising) NTFS so that the user has an idea about where the process is
- Create sparse files when extracting sparse files and no filters are in use for that file
- Ability to drag files to IsoBuster's TreeView, to open as image file, when IsoBuster is running in an elevated state
- Popup warning when extracting from the ISO9660 file system, when other better file systems are present
- Support for the *.image disk file format
- Show attributes for Tracks, Sessions and Partitions in ListView (instead of N/A)
- Fixed it so that HDs larger than 2 TB are seen as 2 TB instead of less, so that at least that space can be fully adressed and explored
- Rewrote the automatic skipping and retry-count reducing mechanism, during extraction of a managed image file, to perform much better
- Allow in the filename, in case an image is extracted via the command line
- Dependency on cc3250.dll for old Win2K OS in combination with multi-language support has been removed
- You can now always choose the installation folder. Before this was dependant on previous installations
- Show the object Type, cfr. Windows, in the ListView (for instance "JPG file") and allow to sort this new column (column may be hidden by default, right mouse click the ListView columns to enable)
- Added more sort options that will be performed right after the low level file system / folder exploring is done
- Various other smaller GUI improvements
Fixes:
- Fixed an exception error that happened if auto-folder-scanning was interrupted by closing the application
- Fixed an issue that could cause the last part of Video not to be saved to a file, when this video was being filtered via: "Extract but filter only MPG frames"
