±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 36445
New Yesterday: 2 Visitors: 203

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

E01 Image format / tools

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

mscotgrove
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 27, 19 21:05

If you really want reverse sector order, why not just read the .E01 file in reverse. As with others who have replied, I do not understand the requirement
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

Passmark
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 27, 19 22:18

Showing my age, but many years ago there was a theory that by "approaching" the disk sector from different "angles" would allow the disk head to position itself slightly differently over the track and maybe allow reading of otherwise bad sectors. Reverse reading was a version of this, done by seeking backwards. Seeking to the edge of the disk and then back to the desired track was another version. Nothing really gets read in reverse at a low level. But the whole theory of reverse reads doesn't even make much sense (in my opinion) as there is so much data in a single track that most of the time seeking backwards won't even move the disk head. i.e the previous sector is on the same track as the current sector. The effect you actually get is much slower disk reads as the read ahead buffer isn't used and the disk head needs to rest in place until the previous sector rotates under it to read it.

But the whole thing is a complex mess now and it often isn't even possible to know the real low level disk layout for modern drives as they have layers of virtualisation on them.
en.wikipedia.org/wiki/...ead-sector

Won't even mention, SSDs, RAID, SANS, caching, automatic relocated sectors, etc...
Modern drives also position the head much more precisely.
I would be surprised if reverse reading was any better than a simple retry on modern drives.

Not saying it is totally pointless. Just mostly pointless.  
 
  

minime2k9
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 28, 19 07:24

My understanding of reverse disk imaging is to do with caching of sectors.

AFAIK, When a disk reads sequentially it caches the sectors after it in anticipation. Where a disk is damaged, this can cause the read to hang but more to do with the caching rather than the sector being read. Reading in reverse removes the caching and therefore allows more sectors to be read.

Again, not sure how true this is but reverse imaging has worked for me in the past, though tools like DDrescue (which goes forwards and then back) are usually do a much better job than tools that generate E01 files when imaging.  
 
  

mscotgrove
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 28, 19 07:53

If you really want reverse sector order, why not just read the .E01 file in reverse. As with others who have replied, I do not understand the requirement
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

Rich2005
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 28, 19 08:13

- mscotgrove
If you really want reverse sector order, why not just read the .E01 file in reverse. As with others who have replied, I do not understand the requirement


As minime says above. It was due to problematic drives.

You could image a problematic drive normally, but it would get to a certain point, where the drive would become unresponsive.
If that point was near the start of the drive you might be getting say 1% of the drive imaged.
The reverse imaging option allowed people to image forwards, until it hung, then image backwards until it hung.
That meant, instead of getting the 1% of the drive, for example, people could get perhaps 99% of the drive imaged.  
 
  

nightworker
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 28, 19 08:58

use ftk imager as source is image file you can convert image  
 
  

jaclaz
Senior Member
 

Re: E01 Image format / tools

Post Posted: Nov 28, 19 10:20

- Passmark

But the whole thing is a complex mess now and it often isn't even possible to know the real low level disk layout for modern drives as they have layers of virtualisation on them.
en.wikipedia.org/wiki/...ead-sector


OT, but JFYI, a nice article about finding out geometry/layout of disks:

blog.stuffedcow.net/20...chmarking/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 2 of 3
Page Previous  1, 2, 3  Next