FTK Imager stalling...
 
Notifications
Clear all

FTK Imager stalling --

13 Posts
8 Users
0 Likes
1,219 Views
Samuel1
(@samuel1)
Posts: 63
Trusted Member
Topic starter
 

Never had this happen before –

I am imaging a 1TB WD My Passport USB drive. Everything goes along peachy, writing about 4GB per 3-4 minutes. But towards 60% completion, it starts to get slower and slower. My gut tells me that the device is having "reallocation events" and is probably suffering from physical failure.

Pressing my ear to the device, I don't hear anything clicking or odd noises, but that doesn't necessarily mean it isn't having a problem.

The enclosure is permanent. That is, WD has made a custom device with a USB-only interface, there is no way to separate it and plug it in directly via SATA.

Anyway, monitoring the progress with Procmon, I can see that FTK Imager is continuing to write data to my E0X files (it's at E91 now) but it's slowed down enormously.

I have tried to image it twice, this has happened each time. I updated FTK Imager, and this is try number three. If it does not complete, I will be at a loss.

Any ideas?

 
Posted : 13/02/2014 9:31 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

You can damage hard drive. It's work for specialized hardware.

 
Posted : 13/02/2014 9:57 am
Samuel1
(@samuel1)
Posts: 63
Trusted Member
Topic starter
 

What would that specialized hardware be?

 
Posted : 13/02/2014 10:01 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

For example, EPOS BadDrive USB http//www.epos.ua/view.php/products_epos_baddrive_usb

EPOS BadDrive USB is intended for

Forensic data acquisition from external HDD/SSD and other Flash drives without opening chassis.
Effective data recovery from unstable and defective USB-HDD without need to create a drive image; safe operation with HDDs of suspicious health.

 
Posted : 13/02/2014 10:11 am
(@mscotgrove)
Posts: 938
Prominent Member
 

It is most likely that a bad or failing area of the disk has been reached.

The next stage depends on how important the data is.

If important the drive should be sent to a specialist repairer who may change the heads, firmware etc. Due to costs, this may not be a viable option for a non critical recovery.

Continued reading of the drive can cause damage or total failure.

If not important, the approach I take is to skip the failed area and build up an image in increments. Often starting near the end of the drive and working backwards. This approach will often get a high percentage of data but there are dangers of disk damage.

A good recovery program will cope with missing areas of a disk image, as long as each recovered sector is in the correct location.

Personally I would avoid programs that try and repair the sectors. Others may suggest otherwise.

 
Posted : 13/02/2014 2:37 pm
(@belkasoft)
Posts: 169
Estimable Member
 

I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.

 
Posted : 13/02/2014 3:17 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.

Sure it is, but it is not like it makes "miracles".

Sometimes one has to deal with the fact that no amount of trickery can recover some sectors. (

The common tool used is ddrescue, see
http//www.forensicfocus.com/Forums/viewtopic/t=11313/
http//www.forensicfocus.com/Forums/viewtopic/t=10839/

jaclaz

 
Posted : 13/02/2014 3:27 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

It is most likely that a bad or failing area of the disk has been reached.

The next stage depends on how important the data is.

If important the drive should be sent to a specialist repairer who may change the heads, firmware etc. Due to costs, this may not be a viable option for a non critical recovery.

Continued reading of the drive can cause damage or total failure.

If not important, the approach I take is to skip the failed area and build up an image in increments. Often starting near the end of the drive and working backwards. This approach will often get a high percentage of data but there are dangers of disk damage.

A good recovery program will cope with missing areas of a disk image, as long as each recovered sector is in the correct location.

Personally I would avoid programs that try and repair the sectors. Others may suggest otherwise.

 
Posted : 13/02/2014 5:21 pm
Samuel1
(@samuel1)
Posts: 63
Trusted Member
Topic starter
 

Thank you all very much for your insights.

It appears as though the image is *nearly* complete. It can be mounted and viewed in FTK. Obviously, it will not be 100% complete. But I imagine it is still workable for the purposes of a limited preview/recovery of data.

 
Posted : 14/02/2014 4:44 am
EricZimmerman
(@ericzimmerman)
Posts: 222
Estimable Member
 

I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.

X-ways can image in reverse

 
Posted : 23/02/2014 3:10 am
Page 1 / 2
Share: