Join Us!

Drive just wont ima...
 
Notifications
Clear all

Drive just wont image, help?  

Page 1 / 2
  RSS
Techie714
(@techie714)
Junior Member

Hey guys, for the life of me I cant get this drive to image. It contains a 10GB profile & I'm trying to make an E01 image. I've used the following products & each one "seems" to lock up after about 10 minutes of making the image.

Products used
FTK Imager 1.8 & 3.0
Encase 6.x
Tableau 1.1.11

Set up
Tableau USB/Firewire 2.0 hardware write blocker connected to a "Bytecc" USB 2.0 adapter/bridge. Then a USB cable to the desktop from the write blocker to make the image. I've done this in the passed using a USB flash drive & it worked perfect. I'm beginning to think this "cheap a*s" USB adapter might be the issue? I have no issues getting it recognized or starting the image on any of the software platforms, just 5 minutes into it appears to just freeze? Any thoughts would be appreciated. Thank you! ?

Quote
Posted : 04/12/2010 12:56 am
mscotgrove
(@mscotgrove)
Senior Member

This is a common problem with drives that are failing. Often the only solution is to power the drive off and on, and then restart imaging. To handle this, I use a process of incremental imaging that allows sections to be skipped, or done at different times. Thus if the area after 10 mins can be read, start reading again from further up the disk.

The link explains the process a bit further. The end result is a DD file, but it may not always be 100% complete, as some parts of the disk may be unreadable. A DD image can always be converted to an E01 if required.

http//www.cnwrecovery.com/html/damaged_disks.html

Incidently, I have found the Tableau T35 adapter extremely good at reading otherwise problem drives

ReplyQuote
Posted : 04/12/2010 1:36 am
Techie714
(@techie714)
Junior Member

Thanks for the info, I'm glad to hear this is such a common issue in this industry..lol. I'll try and use that software you suggested.

ReplyQuote
Posted : 04/12/2010 2:45 am
clownboy
(@clownboy)
Junior Member

Have you tried visually checking the drive for bad sectors? There might be an obvious problem that you can image around.

dd_rescue might work as well.

You could also just let the drive run for a while. I have run across a few drives that seemed to freeze up but if I let them run overnight the image completed (one did take 21+ hours for a 500gb sata drive to complete successfully.)

Good luck.

ReplyQuote
Posted : 04/12/2010 11:58 am
Walkabout_fr
(@walkabout_fr)
Member

I agree with Clownboy. Try to let it run for a few hours, and you'll see. Check the size of the image from time to time and you should see it increase slightly…

Last time I had a failing disk like that, it took FTK Imager 45 hours to image 30GB…

ReplyQuote
Posted : 04/12/2010 2:14 pm
joachimm
(@joachimm)
Active Member

Try the following
* rule-out, as much as possible, hardware causing a possible problem
* use a different type of write blocker, sometimes the write blocker is at fault
* try another tool/OS, e.g. linen/ewfacquire on Linux. Linux can provide you with more detailed information about what is going wrong. However determining the actual cause can be a challenge.

ReplyQuote
Posted : 04/12/2010 2:30 pm
dpcdigex
(@dpcdigex)
New Member

Data recovery is my primary line of business.

As others have suggested, you might try dd_rescue, but run it in reverse. The reverse option will skip the 16mb cache (or whatever size your drive has) and increase your success rate if bad sectors are the issue.

Good luck!

ReplyQuote
Posted : 04/12/2010 6:00 pm
mscotgrove
(@mscotgrove)
Senior Member

The test you need to try is to see if you can still access the drive when it has locked up. If it is just being very slow on failed sectors, then software solutions will work. However, I have come across many drives where the drive just cannot be accessed after certain failures. In these cases, a power cycle is the only way to get life back into the drive.

After a power reset, software is required so imaginging can be continued where it had failed. Hence my incremental imaging approach.

It is true that many disks have only a few bad areas - though often the area is on the MFT / Catalog area of the disk.

ReplyQuote
Posted : 04/12/2010 6:39 pm
vrocco
(@vrocco)
Junior Member

Data recovery is also my primary line of business. If you have any contacts at a local data recovery shop, you may want to see if you can borrow a DeepSpar Imager (most any good DR shop will have at least one). It's a hardware imager with the capability to reset the drive when it encounters bad sectors. It also does some other cool stuff to try and recover bad sectors.

I realize that if this a foresnic case and not just data recovery, you have a chain of custody issue and can't just send a drive somewhere for imaging. You may want to look into buying a DeepSpar yourself. It's not real cheap (~$3500 if I recall), but worth the money.

I am not associated with DeepSpar in any way, but bought one of their imagers about a year ago and it is the absolute gospel in data recovery. No software imaging solution can come close to touching it. They haven't charged for an update yet and their customer service is second to none. They have a user forum for customers which is read daily by their developers. They listen to user suggestions for improvements and I have never waited more than a few hours for a response to a question on their forum.

ReplyQuote
Posted : 04/12/2010 9:18 pm
a_kuiper
(@a_kuiper)
Member

As said use Linux with dd_rescue and the dd_rhelp script.

And… use a fan to cool down the HDD. This makes a tremendous difference!

ReplyQuote
Posted : 04/12/2010 10:25 pm
TuckerHST
(@tuckerhst)
Active Member

A few more suggestions.

1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.

2) The cheap USB connection probably isn't the problem directly; however, because it makes the process much slower, it gives the drive more opportunity to overheat or encounter errors. If at all possible, use eSATA or Firewire 800. Try the Tableau T35es.

3) Finally, I know XWays has this feature, but I don't know what other acquisition software does you can set the read re-try interval (I'm on vacation right now and don't have XWays handy or I would tell you exactly what it's called and where in the UI to find it). When the drive encounters a bad sector, it waits before trying again, sometimes for several seconds (and this varies widely across drive models). Thus, minor damage can make some drives seem like they will never complete. By adjusting this interval down a little, it speeds up the process.

/scott

ReplyQuote
Posted : 04/12/2010 11:49 pm
forensicakb
(@forensicakb)
Active Member

The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.

Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.

Not recommended.

ReplyQuote
Posted : 05/12/2010 12:07 am
a_kuiper
(@a_kuiper)
Member

3) Finally, I know XWays has this feature, but I don't know what other acquisition software does you can set the read re-try interval
/scott

Sorry, but just forget about that… it nearly never works.

If you have a broken disk, even if it's making noises use Linux with dd_rescue.

I succeeded imaging many disks where EnCase, FTK-Imager, Guymager, X-Ways (several versions) failed. With failed I mean they just stopped acquiring and you end up with an imcomplete image.

Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.

You will end up having a dd-image. Just mount it and re-image it if needed.

ReplyQuote
Posted : 05/12/2010 12:22 am
vrocco
(@vrocco)
Junior Member

A few more suggestions.

1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.

The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.

Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.

Not recommended.

Agreed. This is a definite "no-no" from a data recovery standpoint. It will kill the drive far more times than it works.

ReplyQuote
Posted : 05/12/2010 1:10 am
joachimm
(@joachimm)
Active Member

Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.

ewfacquire also has resume functionality (-R option). However the EWF format makes resume more complex than using (split) RAW. So it is slightly less probable the resume will succeed.

ReplyQuote
Posted : 05/12/2010 2:02 am
Page 1 / 2
Share: