±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 4
New Yesterday: 7
Overall: 26221
Visitors: 75

±Forensics Europe Expo


±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

FTK Imager stalling --

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

FTK Imager stalling --

Post Posted: Wed Feb 12, 2014 11:31 pm

Never had this happen before --

I am imaging a 1TB WD My Passport USB drive. Everything goes along peachy, writing about 4GB per 3-4 minutes. But towards 60% completion, it starts to get slower and slower. My gut tells me that the device is having "reallocation events" and is probably suffering from physical failure.

Pressing my ear to the device, I don't hear anything clicking or odd noises, but that doesn't necessarily mean it isn't having a problem.

The enclosure is permanent. That is, WD has made a custom device with a USB-only interface, there is no way to separate it and plug it in directly via SATA.

Anyway, monitoring the progress with Procmon, I can see that FTK Imager is continuing to write data to my E0X files (it's at E91 now) but it's slowed down enormously.

I have tried to image it twice, this has happened each time. I updated FTK Imager, and this is try number three. If it does not complete, I will be at a loss.

Any ideas?  

Samuel1
Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Wed Feb 12, 2014 11:57 pm

You can damage hard drive. It's work for specialized hardware.
_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 


Last edited by Igor_Michailov on Thu Feb 13, 2014 12:06 am; edited 1 time in total

Igor_Michailov
Senior Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 12:01 am

What would that specialized hardware be?  

Samuel1
Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 12:11 am

For example, EPOS BadDrive USB www.epos.ua/view.php/p...ddrive_usb


EPOS BadDrive USB is intended for:

Forensic data acquisition from external HDD/SSD and other Flash drives without opening chassis.
Effective data recovery from unstable and defective USB-HDD without need to create a drive image; safe operation with HDDs of suspicious health.

_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 

Igor_Michailov
Senior Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 4:37 am

It is most likely that a bad or failing area of the disk has been reached.

The next stage depends on how important the data is.

If important the drive should be sent to a specialist repairer who may change the heads, firmware etc. Due to costs, this may not be a viable option for a non critical recovery.

Continued reading of the drive can cause damage or total failure.

If not important, the approach I take is to skip the failed area and build up an image in increments. Often starting near the end of the drive and working backwards. This approach will often get a high percentage of data but there are dangers of disk damage.

A good recovery program will cope with missing areas of a disk image, as long as each recovered sector is in the correct location.

Personally I would avoid programs that try and repair the sectors. Others may suggest otherwise.
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

mscotgrove
Senior Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 5:17 am

I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.
_________________
Digital Evidence Extraction Software
belkasoft.com 

Belkasoft
Senior Member
 
 
  

Re: FTK Imager stalling --

Post Posted: Thu Feb 13, 2014 5:27 am

- Belkasoft
I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.

Sure it is, but it is not like it makes "miracles".

Sometimes one has to deal with the fact that no amount of trickery can recover some sectors. Sad

The common tool used is ddrescue, see:
www.forensicfocus.com/...c/t=11313/
www.forensicfocus.com/...c/t=10839/

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next