If the source drive suddenly stops responding to all commands, as a last resort Guardonix will automatically repower it to seamlessly continue the data acquisition process. In Standard Edition this will happen after 60 seconds of non-response and in Professional Edition the time frame can be configured to 10, 30, or 60 seconds after hardware resets fail to restore readiness.

USB protocol includes an extensive error reporting system which allows the storage device to communicate its issues to the host, which Guardonix then reports in its log.

A project folder is generated for every drive which contains the sector addresses of every successful read, failed read, write attempt, as well as USB-SCSI errors, the drive’s raw ATA DiskID, SCSI Inquiry Data, SCSI VPD Page Serial Number, and USB Descriptor Serial Number. In Professional Edition the drive’s raw S.M.A.R.T. logs can also be saved at any time, for example at the beginning and end of the imaging session to record whether the number of reallocations has changed.

Guardonix has very low power consumption, allowing it to work bus powered with all except the most power hungry USB HDDs, for which the provided 5V power supply does have to be connected.

Guardonix shows the current speed, drive status (idle, busy, disconnected), and sector address.

Every time a read command falls on a bad sector, a typical hard drive will spend somewhere from 4 seconds to over 20 seconds making hundreds of internal read attempts, then conclude the sector is bad, write to its firmware area (located on the platters) to update various logs, and finally respond with an error message. This process wastes time, quickly causes further physical degradation of the drive, and risks firmware corruption. By issuing reset commands, we stop most of this from happening, which dramatically speeds up the rate of error processing, makes the drive develop new bad sectors at a slower pace, and reduces the chance that it will crash completely.

Our engineering team has done thousands of hours of research on the topic of flash storage acquisitions over the USB interface. The interaction of the precise timings of various state changes of USB protocol with the internal timings of each flash storage device being imaged has a large impact on speed. Guardonix hardware & software work together to employ a complex algorithm that automatically adjusts various USB protocol timings during imaging to better synchronize with each flash storage device. This algorithm allows Guardonix to read quick flash storage devices (like SSDs) on average 30% faster than a direct, writeblocker-free connection, reaching imaging speeds above 400MBps. To take full advantage of the high speed offered by Guardonix, we recommend using USB3 controllers made by ASMedia or Intel; practically all other USB3 controllers on the market are poorly designed and will bottleneck the speed to a lower level.

Guardonix allows searching for specific keywords within the data that goes through it in real time (i.e. during imaging). Both ASCII and Unicode encodings are supported, as well as NTFS filesystem metadata, so matches in file/folder names will also be identified. Our algorithm is incredibly efficient, allowing a PC with an average 4-core CPU to search for 20+ keywords without reducing imaging speed (even at 400+MBps), so this search can always be executed without penalty. This search is designed for pre-evaluation/triage purposes only, and as such, we are prioritizing speed of imaging over accuracy. Guardonix will never show a match for a keyword when it is not really there, but it may rarely fail to show a valid match. The exact rate of missed matches ranges from 0.01% to 0.00001% depending on particular keywords and settings.

Optionally prevents Windows from mounting the filesystem (assigning drive letters) of the connected drive, saving time and eliminating the possibility of drive errors causing Windows to hang/crash during mounting. Windows Partition Manager is entirely blocked, making the drive accessible even if critical file system elements have turned into bad sectors.

Degraded SSDs require a completely different read instability handling algorithm than degraded HDDs. Standard Edition is hard coded only for HDDs and Professional Edition can also handle SSDs. This is only relevant for degraded SSDs, so healthy ones will work correctly in both editions.

Many applications and Windows itself automatically perform read retries after failed read attempts. Guardonix can be instructed to prevent these retries by immediately responding with errors when bad blocks are retried sector by sector. In other words, if an application/Windows tries to read a block of sectors, the drive responds with an error, and then that same block is retried one sector at a time, Guardonix will immediately respond to each of those single sector retries with errors without accessing the source drive, which greatly speeds up the imaging process at the cost of losing some good sectors within bad blocks. This option can be controlled at any point during imaging.

Writes can be ignored, in which case Guardonix falsely informs Windows that writes were successful while silently blocking them. This makes applications and Windows work more reliably in some situations, but typically causes Windows to store the contents of the write in cache, which can be undesirable. When writes are being ignored, Guardonix optionally allows saving their contents to the project folder. Alternatively write commands can be responded to with an error, which notifies Windows/applications that the write failed and prevents their contents from being stored in cache.

Shows graphically the status of each read operation on the sector level to communicate whether read commands are successful, timing out, or being responded to with errors. Also shows the graph of the speed, making it easy to identify unexpected speed drops, which points to physical degradation of the storage device.

Practically all modern drives start self-scan procedures after as little as 20 seconds of idling. Self-scan is the drive reading its own surface to find bad/weak sectors to reallocate. This is good for maintenance of healthy drives, but once the drive has bad sectors, this process causes far too much physical degradation and will likely create new bad sectors faster than it reallocates old ones. More importantly, data will often be lost because most drives will still reallocate sectors even if they can’t first retrieve their contents; in other words, weak sectors will be changing their contents without any user input. This option allows turning off source drive power after a customizable period of inactivity, preventing self-scans from happening.

*These features are only guaranteed to work on SATA devices with the optional Set of Adapters that we supply. Other adapters may not be capable of passing on the necessary commands, which is outside our control.