Blank Flop?

The first question I always ask when someone says it "supposedly has data on it"

How do you know that, and why?

When I first started out I spent forever working on a drive someone was "sure it has data on it" come to find out that no it had no data on it and they were wrong.

I have a floppy given to me that supposedly has data on it. However, it appears
completely blank to me, not even a sign of formating . I have an old copy of encase 4 and when I create a new case, import the floppy as a "device", and then look at it in hex view (or any other view) I see nothing! No hex, no 0's, just blank. No sign of any formatting, deleteted partitions, etc. whatsoever!

EnCase, of course, relies on the operating system and its device drivers to extract information from the floppy, and they probably assume that it uses one of the standard DOS/Windows floppy formats.

If you know that it does follow those conventions, the examination is over.

However, if you do not know, you may need to examine what exactly is present on each track – not just assume that there are only 9 sectors per track, etc., or that they use some particular sector numbering (See http// en . wikipedia . org/wiki/List_of_floppy_disk_formats for some additional details.)

On linux, the fdutils can help. (See http// www . fdutils . linux.lu/disk-id.html for practical suggestions.)

In general, the Kryoflux device reads floppies at a very low level. It's commercial, so there are licensing issues to be aware of. (Google for 'Kryoflux').

There's also the Catweasel (http// en . wikipedia . org/wiki/Individual_Computers_Catweasel), but availability may be an issue.

Also see http// www . forensicfocus . com/Forums/viewtopic/t=6693/ .

What size floppy, 3", 3.5", 5.25", 8"?

Although 99% of current floppies are high density 3.5" 18 sectors per track, in my earlier life I developed a product to read about 2,000 variations of floppy disks. Most are soft sectors, but some use non standard recording techniques that would blank to a current PC. Apple where probably the most common, also Commodore.

MFM is the most common recording method, but GCR, M2FM and many other do exist. 48tpi, 96tpi, 100tpi, etc

Where did your disk come from? It may contain data, but not in a format you would recognise. OR it could be blank.

I forget, when I make a "forensic copy" (from original floppy to working copy) am I supposed to use a completely wiped disk or a formatted disk for my copy?

Thanks
mj

Is this homework, or a study project?

I forget, when I make a "forensic copy" (from original floppy to working copy) am I supposed to use a completely wiped disk or a formatted disk for my copy?

Thanks
mj

Homework? CF is a hobby of mine and unfortunately I am not that "social" so I use BBs such as this when I need advice.

thanks,
mj

mj, if you are cloning, your destination should be sterile. If you are imaging, then the container should protect the integrity.

Is this homework, or a study project?

I forget, when I make a "forensic copy" (from original floppy to working copy) am I supposed to use a completely wiped disk or a formatted disk for my copy?

Thanks
mj

It is difficult to clone a floppy disk. The disk contains a series of bit changes, half are clock bits and half are data bits. When a new sector is written, the clock and data may be out of sync with the header.

It is therefore safest to read the disk sector by sector and copy the sectors. This will fail on some disks with odd sectoring, but if you have a common 18 x 512 x 80 x ds x hd it will work.

It is difficult to clone a floppy disk. The disk contains a series of bit changes, half are clock bits and half are data bits. When a new sector is written, the clock and data may be out of sync with the header.

It is therefore safest to read the disk sector by sector and copy the sectors. This will fail on some disks with odd sectoring, but if you have a common 18 x 512 x 80 x ds x hd it will work.

Yep, but there are still a number of "dedicated" floppy cloning programs, obviously DOS based, that can normally clone even the "impossible".

There is an extensive discussion with links, tests and what not here
http//www.msfn.org/board/topic/136856-how-to-archive-old-floppies-for-access-under-win98/

The "right" thing to do would be of course to put your hands on a dedicated hardware, a Central Point Option Board is - I guess - practically UNfindable, but something like the Catweasel
http//www.jschoenfeld.com/products/catweasel_ISA_e.htm

or (possibly) Kryoflux
http//www.softpres.org/glossaryKryoFlux
http//www.kryoflux.com/
might help.

Should one need to read an over-sectored floppy on 2K/XP, a special driver is needed, like
http//alter.org.ua/en/soft/win/floppy/
more info here
http//www.serverelements.com/forums/viewtopic.php?t=64

but using "pure" DOS is always adviced.

jaclaz