I am using the Wiebetech Ditto to obtain images from suspect drives. All has been working great until the latest image. I completed an imaging of a hard drive and the ditto reported that the image was completed.
The trouble comes when I try to open the hard drive with the image. The hard drive does not appear on the computer when I connect it in order to us FTK 5. If however I got into the disk management the drive is there but all options are shaded out (new volume and the like).
I would appreciate any help in getting access to the image file which as far as Ditto says is located on this drive
Are you using a write blocker with the drive? I bet if you mount the physical drive with FTK Imager you will see your data.
I used all the advice, thank you all and by opening the drive in FTK as a physical drive I have found what I am after, thanks guys for all the help
The WiebeTech Ditto formats its destination drive as ext4 so perhaps that was the problem (I was unclear from your post if you were able to see the other images on the destination drive or if you could not see any of them). If your examination computer is a Windows-based system, it will not natively see the ext4-formatted hard drive. One option is to use FTK Imager as indicated. I have also used Disk Internals Linux Reader (http//
Guys,
I used the FTK fix and everything worked fine, however I have performed another image with Ditto and the unit stated the image was created successfully. I then tried the FTK method with no luck and also eyez0ns idea of using disk internals. With disk internals it has shown the drive as unallocated space and I can't access it. In FTK I can open the physical drive but there is no E01 file anywhere although I do have Partition 1 with an unrecognised file system and the unpartitioned space which holds an unallocated space folder and a MBR.
what did you see in mbr you can access sector 0 look before 55 AA and is there a partition