±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35997
New Yesterday: 1 Visitors: 150

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Drive just wont image, help?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

mscotgrove
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 19:39

The test you need to try is to see if you can still access the drive when it has locked up. If it is just being very slow on failed sectors, then software solutions will work. However, I have come across many drives where the drive just cannot be accessed after certain failures. In these cases, a power cycle is the only way to get life back into the drive.

After a power reset, software is required so imaginging can be continued where it had failed. Hence my incremental imaging approach.

It is true that many disks have only a few bad areas - though often the area is on the MFT / Catalog area of the disk.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

vrocco
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 22:18

Data recovery is also my primary line of business. If you have any contacts at a local data recovery shop, you may want to see if you can borrow a DeepSpar Imager (most any good DR shop will have at least one). It's a hardware imager with the capability to reset the drive when it encounters bad sectors. It also does some other cool stuff to try and recover bad sectors.

I realize that if this a foresnic case and not just data recovery, you have a chain of custody issue and can't just send a drive somewhere for imaging. You may want to look into buying a DeepSpar yourself. It's not real cheap (~$3500 if I recall), but worth the money.

I am not associated with DeepSpar in any way, but bought one of their imagers about a year ago and it is the absolute gospel in data recovery. No software imaging solution can come close to touching it. They haven't charged for an update yet and their customer service is second to none. They have a user forum for customers which is read daily by their developers. They listen to user suggestions for improvements and I have never waited more than a few hours for a response to a question on their forum.  
 
  

a_kuiper
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 23:25

As said: use Linux with dd_rescue and the dd_rhelp script.

And... use a fan to cool down the HDD. This makes a tremendous difference!  
 
  

TuckerHST
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 00:49

A few more suggestions.

1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.

2) The cheap USB connection probably isn't the problem directly; however, because it makes the process much slower, it gives the drive more opportunity to overheat or encounter errors. If at all possible, use eSATA or Firewire 800. Try the Tableau T35es.

3) Finally, I know XWays has this feature, but I don't know what other acquisition software does: you can set the read re-try interval (I'm on vacation right now and don't have XWays handy or I would tell you exactly what it's called and where in the UI to find it). When the drive encounters a bad sector, it waits before trying again, sometimes for several seconds (and this varies widely across drive models). Thus, minor damage can make some drives seem like they will never complete. By adjusting this interval down a little, it speeds up the process.

/scott
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 
 
  

forensicakb
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 01:07

The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.

Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.

Not recommended.  
 
  

a_kuiper
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 01:22

- TuckerHST

3) Finally, I know XWays has this feature, but I don't know what other acquisition software does: you can set the read re-try interval
/scott


Sorry, but just forget about that... it nearly never works.

If you have a broken disk, even if it's making noises use Linux with dd_rescue.

I succeeded imaging many disks where EnCase, FTK-Imager, Guymager, X-Ways (several versions) failed. With failed I mean they just stopped acquiring and you end up with an imcomplete image.

Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.

You will end up having a dd-image. Just mount it and re-image it if needed.  
 
  

vrocco
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 02:10

- TuckerHST
A few more suggestions.

1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.


- forensicakb
The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.

Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.

Not recommended.



Agreed. This is a definite "no-no" from a data recovery standpoint. It will kill the drive far more times than it works.  
 

Page 2 of 3
Page Previous  1, 2, 3  Next