±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35131
New Yesterday: 2 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

How to forensically image a 2Tb External HDD

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Fri Nov 10, 2017 1:22 am

- sim4n6


I extracted the HDD from the case and connect it through SATA


Try connecting it through a USB writeblocker and then imaging it. If its USB 3 it should be fairly quick anyway.  

minime2k9
Senior Member
 
 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Fri Nov 10, 2017 8:42 am

I don't get what you mean by *USB 3 Write Blocker*, the HDD got a SATA interface so .... do you mean that I have to use a *SATA to USB 3 adapter* ?  

Simarno
Member
 
 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Fri Nov 10, 2017 8:44 am

- sim4n6
I don't get what you mean by *USB 3 Write Blocker*, the HDD got a SATA interface so .... do you mean that I have to use a *SATA to USB 3 adapter* ?


I may have misunderstood your last answer.

Is this an external hard disk that came in a plastic casing with a circuit board to make it USB3 or is it simply a 3.5" spinning hard disk with nothing else?  

minime2k9
Senior Member
 
 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Fri Nov 10, 2017 8:53 am

3.5" spinning one  

Simarno
Member
 
 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Fri Nov 10, 2017 8:57 am

Sorry got the wrong end of the stick.

Do you have multiple imaging machines? Can you try it on another one?
What software are you using to image the disk?  

minime2k9
Senior Member
 
 
  

Re: How to forensically image a 2Tb External HDD

Post Posted: Wed Jan 16, 2019 11:19 pm

I would do it two ways if you have the time and resources.

First is to take the NAS unit and direct attach it to your workstation and grab an image before you take it apart and break it - just in case! Image it first direct attached. In Windows you can use diskpart to disable automount. Carefully document your steps no matter what procedure you use.

Depending on the model of the NAS unit, you can take it apart and the image the drive(s) individually. Most of them are simple, RAID-0 stripe usually 64kb or 512kb, XFS or EXT4 file system. But some are 1/2 kb stripe or a span. Don't even mess with a Drobo! And some WDs have an encrypted bridge.

Good luck,  

jahearne
Member
 
 

Page 2 of 2
Go to page Previous  1, 2