Stellar Phoenix is a product aimed at data recovery, rather than strict forensics, although of course recovery is an important part of incident response. Confronted with a disk with damaged or missing data, the software will attempt to recover information and reconstruct partial data.
Like several other products in this space, Stellar Phoenix requires a security dongle (in this case, an Aladdin HASP device) before it will run. In addition, the local user must have at least power user privileges, preventing normal users from using the software to access files they should not.
Phoenix is very simple to use, with a familiar Windows file-explorer type interface. The first step is to identify a target drive, partition or logical drive (the software will scan drives for partition information).
The system only works on physically connected devices, not on disk images, which is a shame. But given its primary purpose is a data recovery tool not a forensic product, this was not unexpected.
Once a target drive is identified, Phoenix scans the drive for files and folders, including fragments outside the file allocation tables, lost partitions, and data on formatted drives. It does this very quickly, although it might take a lot longer on a seriously damaged drive, particularly if there is any physical damage.
With the tree of data ready to go, files and folders are marked for recovery by ticking a check box in the tree view.
One click of the mouse, and recovery begins, with a prompt for where to store the data on the system's home filesystem. With our sample data, this was very quick, even with hefty chunks of information to restore.
There are some limitations to the product which count against it. Only Windows file systems can be examined (Stellar has separate products for other file systems), and file searching is primitive.
In addition, with only limited auditing and no hashing at all, we would suggest that you use this in conjunction with another forensic file recovery tool. But we really like the clean interface and quick performance of the software.
As a product with a specific task to accomplish, Stellar Phoenix does the job very well.
