SectorSpy is basically a data recovery utility that can be useful in recovering data from a hard drive from which you are unable to access with an operating system. You can also examine data at the sector level. I think it might be best left to those familiar with the workings of a hard drive, as it does require a good deal of input from the user. In order to access the drive at a low level, it bypasses built in safeguards designed to prevent you from doing exactly what SectorSpy allows. The author also makes it clear that you need to be careful, and even recommends using this tool a last resort.
I have used another utility from Norton, Disk Edit, which is included in the Norton Utilities Suite, that does the same things as SectorSpy, but allows direct disk editing and manipulating at any location. This allowed me to compare the two. The most obvious differences are SectorSpy is free while Norton is not, SectorSpy runs from Windows, while Disk Edit runs on a machine booted into DOS, and SectorSpy is aimed at data search/recovery, and Norton is a true disk editor.
The author suggests using SectorSpy to recover potential evidence which ostensibly could be used to prosecute someone. You would do this by accessing the drive/disc with SectorSpy, and a search function to look for key text. It displays whatever it finds on the target, but most of what is displayed is in hex code, and is generally unintelligible to most people. Any useful information can be copied to another drive/disc without contaminating the data on the target. Figure 1 is typical of what you will see with SectorSpy. Notice the number of sectors. The search function does one sector at a time so you can see it takes awhile to completely search a drive. This particular one is a single 8GB partition on a much larger drive. I had it set for the default speed, 750, which searches one sector each 3/4 second. This partition had over 16 million sectors. At one sector at a time, well…, you do the math. Fortunately, you can use the keys to skip quickly from section to section, designate a particular section, or set parameters for searching for sectors containing mostly text. The help file is good, and explains the operations in plain language.
I did have some problems using this utility; two crashes on two machines. Since Windows is infamous for this anyway, I don’t know if it was SectorSpy, or Windows. Doing some detective work, I decided it might be related to either my anti-virus software (McAfee), or the firewall (ZoneAlarm), so I deactivated both and tried again. This time it worked, but illustrates what I think is the disadvantage of using SectorSpy, namely that it runs from Windows. It does work though, and I successfully used the search function to find specific text on the drive, and append (copy) it to another drive. I also was using Windows 98SE, which is supported by SectorSpy.
You obviously understand it only works on a drive that is functional mechanically, as no software recovery application is capable of repairing/recovering data from a mechanically dead drive. If you do need to recover data from a drive that does not have a functioning OS, there are better applications. By better, I mean they are more automated, and require less skill from the user. Two that I have tried that are specifically made for this are SpinRite v5 from Gibson Research (www.grc.com/sroverview.htm), and EasyRecovery DataRecovery by OnTrack (www.ontrack.com/easyrecoverydatarecovery/index.sap). Norton Utilities Disk Edit (www.symantec.com/product/) does much the same as SectorSpy, I think is more capable, but is more difficult and can really cause trouble if not properly used. These also have the same feature I like, which is they all boot off a disk and do not depend on a functioning operating system. SectorSpy does work, is relatively easy to use, and is freeware. The author, Nick McCamy, has done a good job, and this is a useful tool that you should have in your tool box. Before you use it, be sure you read and understand the instructions. You should look around on his web site, as he has other programs available that you will probably find useful.
You can reach Nick McCamy and check out or download the program. You can reach Russell Albach if you have questions about his experiences with the program.
