Drive just wont ima...
 
Notifications
Clear all

Drive just wont image, help?

20 Posts
12 Users
0 Likes
1,657 Views
(@techie714)
Posts: 37
Eminent Member
Topic starter
 

Hey guys, for the life of me I cant get this drive to image. It contains a 10GB profile & I'm trying to make an E01 image. I've used the following products & each one "seems" to lock up after about 10 minutes of making the image.

Products used
FTK Imager 1.8 & 3.0
Encase 6.x
Tableau 1.1.11

Set up
Tableau USB/Firewire 2.0 hardware write blocker connected to a "Bytecc" USB 2.0 adapter/bridge. Then a USB cable to the desktop from the write blocker to make the image. I've done this in the passed using a USB flash drive & it worked perfect. I'm beginning to think this "cheap a*s" USB adapter might be the issue? I have no issues getting it recognized or starting the image on any of the software platforms, just 5 minutes into it appears to just freeze? Any thoughts would be appreciated. Thank you! ?

 
Posted : 04/12/2010 12:56 am
(@mscotgrove)
Posts: 938
Prominent Member
 

This is a common problem with drives that are failing. Often the only solution is to power the drive off and on, and then restart imaging. To handle this, I use a process of incremental imaging that allows sections to be skipped, or done at different times. Thus if the area after 10 mins can be read, start reading again from further up the disk.

The link explains the process a bit further. The end result is a DD file, but it may not always be 100% complete, as some parts of the disk may be unreadable. A DD image can always be converted to an E01 if required.

http//www.cnwrecovery.com/html/damaged_disks.html

Incidently, I have found the Tableau T35 adapter extremely good at reading otherwise problem drives

 
Posted : 04/12/2010 1:36 am
(@techie714)
Posts: 37
Eminent Member
Topic starter
 

Thanks for the info, I'm glad to hear this is such a common issue in this industry..lol. I'll try and use that software you suggested.

 
Posted : 04/12/2010 2:45 am
(@clownboy)
Posts: 46
Eminent Member
 

Have you tried visually checking the drive for bad sectors? There might be an obvious problem that you can image around.

dd_rescue might work as well.

You could also just let the drive run for a while. I have run across a few drives that seemed to freeze up but if I let them run overnight the image completed (one did take 21+ hours for a 500gb sata drive to complete successfully.)

Good luck.

 
Posted : 04/12/2010 11:58 am
(@walkabout_fr)
Posts: 67
Trusted Member
 

I agree with Clownboy. Try to let it run for a few hours, and you'll see. Check the size of the image from time to time and you should see it increase slightly…

Last time I had a failing disk like that, it took FTK Imager 45 hours to image 30GB…

 
Posted : 04/12/2010 2:14 pm
(@joachimm)
Posts: 181
Estimable Member
 

Try the following
* rule-out, as much as possible, hardware causing a possible problem
* use a different type of write blocker, sometimes the write blocker is at fault
* try another tool/OS, e.g. linen/ewfacquire on Linux. Linux can provide you with more detailed information about what is going wrong. However determining the actual cause can be a challenge.

 
Posted : 04/12/2010 2:30 pm
(@dpcdigex)
Posts: 10
Active Member
 

Data recovery is my primary line of business.

As others have suggested, you might try dd_rescue, but run it in reverse. The reverse option will skip the 16mb cache (or whatever size your drive has) and increase your success rate if bad sectors are the issue.

Good luck!

 
Posted : 04/12/2010 6:00 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

The test you need to try is to see if you can still access the drive when it has locked up. If it is just being very slow on failed sectors, then software solutions will work. However, I have come across many drives where the drive just cannot be accessed after certain failures. In these cases, a power cycle is the only way to get life back into the drive.

After a power reset, software is required so imaginging can be continued where it had failed. Hence my incremental imaging approach.

It is true that many disks have only a few bad areas - though often the area is on the MFT / Catalog area of the disk.

 
Posted : 04/12/2010 6:39 pm
(@vrocco)
Posts: 33
Eminent Member
 

Data recovery is also my primary line of business. If you have any contacts at a local data recovery shop, you may want to see if you can borrow a DeepSpar Imager (most any good DR shop will have at least one). It's a hardware imager with the capability to reset the drive when it encounters bad sectors. It also does some other cool stuff to try and recover bad sectors.

I realize that if this a foresnic case and not just data recovery, you have a chain of custody issue and can't just send a drive somewhere for imaging. You may want to look into buying a DeepSpar yourself. It's not real cheap (~$3500 if I recall), but worth the money.

I am not associated with DeepSpar in any way, but bought one of their imagers about a year ago and it is the absolute gospel in data recovery. No software imaging solution can come close to touching it. They haven't charged for an update yet and their customer service is second to none. They have a user forum for customers which is read daily by their developers. They listen to user suggestions for improvements and I have never waited more than a few hours for a response to a question on their forum.

 
Posted : 04/12/2010 9:18 pm
(@a_kuiper)
Posts: 69
Trusted Member
 

As said use Linux with dd_rescue and the dd_rhelp script.

And… use a fan to cool down the HDD. This makes a tremendous difference!

 
Posted : 04/12/2010 10:25 pm
Page 1 / 2
Share: