Introduction to AnaDisk
AnaDisk turns your PC into a sophisticated diskette analysis tool. The software was originally created to meet the needs of the U. S. Treasury Department in 1991. It is primarily used to identify data storage anomalies on floppy diskettes and generic hardware in the form of floppy disk controllers and bios are needed when using this software. It works at a very low level and makes maximum use of the floppy diskette hardware. The software also has limited search capabilities and can be used to copy "abnormal" diskettes. It can also be used to write data at a physical sector level and to format diskettes using any number of combinations. This software is described and its uses are discussed in the books Computer Forensics, Computer Crime Scene Investigations Cyber Crime Investigator's Field Guide.
AnaDisk can be used to analyze floppy diskettes when doing work which involves abnormal floppy diskettes or data storage issues tied to floppy diskettes. NTI uses this tool when it creates special training diskettes for use in its popular Computer Forensics Training Course because it can be used to create data hiding areas by adding extra sectors and/or tracks to floppy diskettes. It can also be used to write data to "unformatted" floppy diskettes. This unique software was created by Chuck Guzis at Sydex, Inc. and it was sold to NTI by Sydex in March 2000. Chuck probably knows more about floppy disk issues and processes than any other individual in the computer forensics community and he continues to provide software upgrade support for this software.
AnaDisk has the capability to duplicate floppy diskettes but this feature is used primarily with odd diskette formats, e.g., in cases like the FBI Russian mole case of suspected spy Robert Phillip Hanssen. However standard duplication of floppy diskettes is more easily accomplished with NTI's CopyQM which has been upgraded and certified by the U. S. Department of Defense for use in making copies of diskettes used in classified computer security risk reviews.
AnaDisk - Primary Uses:
- Security reviews of floppy diskettes for storage anomalies.
- Duplication of diskettes which are non-standard or which involve storage anomalies.
- Editing diskettes at a physical sector level.
- Searching for data on floppy diskettes in traditional and non-traditional storage areas.
- Formatting diskettes in non-traditional ways for training purposes and to illustrate data hiding techniques.
AnaDisk - Program Features and Benefits:
- DOS based for ease of operation and speed.
- No Software Dongle! - We know that software dongles get in the way and they are restrictive. That is why NTI does not use software dongles.
- Key word searches can be conducted at a very low level and on diskettes that have been formatted with extra tracks and/or extra tracks. This feature is helpful in the evaluation of diskettes which may involve sophisticated data hiding techniques.
- All DOS formats are supported as well as many non-DOS formats, e.g., Apple Macintosh, Unix TAR and many others. If the diskette will fit in a PC floppy diskette drive, it is likely that AnaDisk can be used to analyze it.
- Allows custom formatting of diskettes with extra tracks and sectors.
- Scans for anomalies will identify odd formats, extra tracks and extra sectors. Data mismatches, concerning some file formats, are also identified when file extensions have been changed in an attempt to hide data.
- This software can be used to copy almost any diskette including most copy protected diskettes.
For definitions of some of the technical computer forensic terms used, please refer to our technical definitions section.
The current release is Version 2.10 and the GSA Product Number is ANA210.
U. S. Government clients may click here for information about GSA purchases.