Notifications
Clear all

can't get physical image from HPFS/NFTS partition

3 Posts
2 Users
0 Likes
463 Views
(@digitalcoroner)
Posts: 46
Eminent Member
Topic starter
 

I have tried FTK Imager 3.1.2 and FTK 5.0 to take a physical image off of a hard drive that has a HPFS/NTFS partition. The partition always shows up as unrecognized. The hard drive is encrypted using SAFENET. I've tried imaging with the hard drive in the laptop and logged in as admin and have taken the hard drive out and directly connected to an imaging station. FTK never prompts for SAFENET credentials either. Thanks.

 
Posted : 18/07/2013 6:06 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I have tried FTK Imager 3.1.2 and FTK 5.0 to take a physical image off of a hard drive that has a HPFS/NTFS partition. The partition always shows up as unrecognized. The hard drive is encrypted using SAFENET. I've tried imaging with the hard drive in the laptop and logged in as admin and have taken the hard drive out and directly connected to an imaging station. FTK never prompts for SAFENET credentials either. Thanks.

Since you are going for a physical image (I presume of the whole disk, not just of the partition/volume) why don't you try with a "plainer" dd (or similar)?

Physical image - in theory - should be completely filesystem/partitioning scheme/whatever "agnostic", it should be a simple byte by byte, sector by sector copy of the original.

Is it not that - for whatever reason, connected or not connected with SAFENET - that hard disk has HPA (or similar "hidden" content)?

jaclaz

 
Posted : 18/07/2013 7:55 pm
(@digitalcoroner)
Posts: 46
Eminent Member
Topic starter
 

No HP present. I'll try dd, thanks.

 
Posted : 22/07/2013 2:53 pm
Share: