±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35765
New Yesterday: 3 Visitors: 140

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Drive just wont image, help?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3 
  

joachimm
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 03:02

- a_kuiper
Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.


ewfacquire also has resume functionality (-R option). However the EWF format makes resume more complex than using (split) RAW. So it is slightly less probable the resume will succeed.  
 
  

TuckerHST
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 03:42

- forensicakb
Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.


Sorry! I keep forgetting that not everyone lives in the desert. Definitely don't do this in a humid environment, ever. And, yes, I consider it a last resort but have had good results. In the desert. Very Happy

/scott

p.s. I'll try dd_rescue before freezing another drive.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 
 
  

farmerdude
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 05, 10 22:06

If you've not already killed that drive Smile then I recommend you look at 'ddrescue', which is _not_ the same as the script 'dd_rescue'. ddrescue is a very different animal from dd_rescue and I've been a believer for a couple of years now. So much so that it's become a staple in work and in my training classes.

Cheers!

farmerdude

www.onlineforensictraining.com

www.forensicbootcd.com  
 
  

a_kuiper
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 06, 10 00:52

- joachimm

ewfacquire also has resume functionality (-R option). However the EWF format makes resume more complex than using (split) RAW. So it is slightly less probable the resume will succeed.


Thanks for the hint. I will give it a try!  
 
  

vrocco
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 06, 10 04:05

Just re-read the OP and realized you are trying to image through USB. You may have far better results using the native interface of the drive instead (IDE or SATA).  
 
  

Beetle
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 06, 10 05:33

- farmerdude
If you've not already killed that drive Smile then I recommend you look at 'ddrescue', which is _not_ the same as the script 'dd_rescue'. ddrescue is a very different animal from dd_rescue and I've been a believer for a couple of years now. So much so that it's become a staple in work and in my training classes.

Cheers!

farmerdude

www.onlineforensictraining.com

www.forensicbootcd.com


Agreed whole heartedly. Saved me a couple of times when all other software "got stuck" on some blocks that were starting to fail.  
 

Page 3 of 3
Page Previous  1, 2, 3