±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36212
New Yesterday: 0 Visitors: 116

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Drive just wont image, help?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

Techie714
Member
 

Drive just wont image, help?

Post Posted: Dec 04, 10 00:56

Hey guys, for the life of me I cant get this drive to image. It contains a 10GB profile & I'm trying to make an E01 image. I've used the following products & each one "seems" to lock up after about 10 minutes of making the image.

Products used:
FTK Imager 1.8 & 3.0
Encase 6.x
Tableau 1.1.11

Set up:
Tableau USB/Firewire 2.0 hardware write blocker connected to a "Bytecc" USB 2.0 adapter/bridge. Then a USB cable to the desktop from the write blocker to make the image. I've done this in the passed using a USB flash drive & it worked perfect. I'm beginning to think this "cheap ass" USB adapter might be the issue? I have no issues getting it recognized or starting the image on any of the software platforms, just 5 minutes into it appears to just freeze? Any thoughts would be appreciated. Thank you! Question  
 
  

mscotgrove
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 01:36

This is a common problem with drives that are failing. Often the only solution is to power the drive off and on, and then restart imaging. To handle this, I use a process of incremental imaging that allows sections to be skipped, or done at different times. Thus if the area after 10 mins can be read, start reading again from further up the disk.

The link explains the process a bit further. The end result is a DD file, but it may not always be 100% complete, as some parts of the disk may be unreadable. A DD image can always be converted to an E01 if required.

www.cnwrecovery.com/ht...disks.html

Incidently, I have found the Tableau T35 adapter extremely good at reading otherwise problem drives
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

Techie714
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 02:45

Thanks for the info, I'm glad to hear this is such a common issue in this industry..lol. I'll try and use that software you suggested.  
 
  

clownboy
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 11:58

Have you tried visually checking the drive for bad sectors? There might be an obvious problem that you can image around.

dd_rescue might work as well.

You could also just let the drive run for a while. I have run across a few drives that seemed to freeze up but if I let them run overnight the image completed (one did take 21+ hours for a 500gb sata drive to complete successfully.)

Good luck.  
 
  

Walkabout_fr
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 14:14

I agree with Clownboy. Try to let it run for a few hours, and you'll see. Check the size of the image from time to time and you should see it increase slightly...

Last time I had a failing disk like that, it took FTK Imager 45 hours to image 30GB...
_________________
Marc ETIENNEY,
Investigator
Office of Internal Oversight Services
World Health Organization 
 
  

joachimm
Senior Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 14:30

Try the following:
* rule-out, as much as possible, hardware causing a possible problem
* use a different type of write blocker, sometimes the write blocker is at fault
* try another tool/OS, e.g. linen/ewfacquire on Linux. Linux can provide you with more detailed information about what is going wrong. However determining the actual cause can be a challenge.  
 
  

dpcdigex
Member
 

Re: Drive just wont image, help?

Post Posted: Dec 04, 10 18:00

Data recovery is my primary line of business.

As others have suggested, you might try dd_rescue, but run it in reverse. The reverse option will skip the 16mb cache (or whatever size your drive has) and increase your success rate if bad sectors are the issue.

Good luck!  
 

Page 1 of 3
Page 1, 2, 3  Next