Never had this happen before –
I am imaging a 1TB WD My Passport USB drive. Everything goes along peachy, writing about 4GB per 3-4 minutes. But towards 60% completion, it starts to get slower and slower. My gut tells me that the device is having "reallocation events" and is probably suffering from physical failure.
Pressing my ear to the device, I don't hear anything clicking or odd noises, but that doesn't necessarily mean it isn't having a problem.
The enclosure is permanent. That is, WD has made a custom device with a USB-only interface, there is no way to separate it and plug it in directly via SATA.
Anyway, monitoring the progress with Procmon, I can see that FTK Imager is continuing to write data to my E0X files (it's at E91 now) but it's slowed down enormously.
I have tried to image it twice, this has happened each time. I updated FTK Imager, and this is try number three. If it does not complete, I will be at a loss.
Any ideas?
You can damage hard drive. It's work for specialized hardware.
What would that specialized hardware be?
For example, EPOS BadDrive USB http//
EPOS BadDrive USB is intended for
Forensic data acquisition from external HDD/SSD and other Flash drives without opening chassis.
Effective data recovery from unstable and defective USB-HDD without need to create a drive image; safe operation with HDDs of suspicious health.
It is most likely that a bad or failing area of the disk has been reached.
The next stage depends on how important the data is.
If important the drive should be sent to a specialist repairer who may change the heads, firmware etc. Due to costs, this may not be a viable option for a non critical recovery.
Continued reading of the drive can cause damage or total failure.
If not important, the approach I take is to skip the failed area and build up an image in increments. Often starting near the end of the drive and working backwards. This approach will often get a high percentage of data but there are dangers of disk damage.
A good recovery program will cope with missing areas of a disk image, as long as each recovered sector is in the correct location.
Personally I would avoid programs that try and repair the sectors. Others may suggest otherwise.
I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.
I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.
Sure it is, but it is not like it makes "miracles".
Sometimes one has to deal with the fact that no amount of trickery can recover some sectors. (
The common tool used is ddrescue, see
http//www.forensicfocus.com/Forums/viewtopic/t=11313/
http//www.forensicfocus.com/Forums/viewtopic/t=10839/
jaclaz
It is most likely that a bad or failing area of the disk has been reached.
The next stage depends on how important the data is.
If important the drive should be sent to a specialist repairer who may change the heads, firmware etc. Due to costs, this may not be a viable option for a non critical recovery.
Continued reading of the drive can cause damage or total failure.
If not important, the approach I take is to skip the failed area and build up an image in increments. Often starting near the end of the drive and working backwards. This approach will often get a high percentage of data but there are dangers of disk damage.
A good recovery program will cope with missing areas of a disk image, as long as each recovered sector is in the correct location.
Personally I would avoid programs that try and repair the sectors. Others may suggest otherwise.
Thank you all very much for your insights.
It appears as though the image is *nearly* complete. It can be mounted and viewed in FTK. Obviously, it will not be 100% complete. But I imagine it is still workable for the purposes of a limited preview/recovery of data.
I'm pretty sure there is a topic somewhere on FF covering the acquisition of hard drives containing bad sectors. If I remember correctly, general consensus was using a backwards reading was the recommended approach.
X-ways can image in reverse