A few more suggestions.
1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.
2) The cheap USB connection probably isn't the problem directly; however, because it makes the process much slower, it gives the drive more opportunity to overheat or encounter errors. If at all possible, use eSATA or Firewire 800. Try the Tableau T35es.
3) Finally, I know XWays has this feature, but I don't know what other acquisition software does you can set the read re-try interval (I'm on vacation right now and don't have XWays handy or I would tell you exactly what it's called and where in the UI to find it). When the drive encounters a bad sector, it waits before trying again, sometimes for several seconds (and this varies widely across drive models). Thus, minor damage can make some drives seem like they will never complete. By adjusting this interval down a little, it speeds up the process.
/scott
The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.
Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.
Not recommended.
3) Finally, I know XWays has this feature, but I don't know what other acquisition software does you can set the read re-try interval
/scott
Sorry, but just forget about that… it nearly never works.
If you have a broken disk, even if it's making noises use Linux with dd_rescue.
I succeeded imaging many disks where EnCase, FTK-Imager, Guymager, X-Ways (several versions) failed. With failed I mean they just stopped acquiring and you end up with an imcomplete image.
Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.
You will end up having a dd-image. Just mount it and re-image it if needed.
A few more suggestions.
1) Freeze the drive. Really. Stick it in the freezer for a few hours, then image it. While imaging, keep it cool with a freezer pack on top of it. I have had success with this method on troublesome drives.
The freezer idea while it may work a few times out of 100 or 1k, is a very bad idea.
Too many bad things can happen. Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.
Not recommended.
Agreed. This is a definite "no-no" from a data recovery standpoint. It will kill the drive far more times than it works.
Another nice thing about dd_rescue is that acquisitions can be resumed. I have no idea why no imaging-software allows to continue after an interruption.
ewfacquire also has resume functionality (-R option). However the EWF format makes resume more complex than using (split) RAW. So it is slightly less probable the resume will succeed.
Think about it from the standpoint of what happens when you take something cold and then heat it up very fast, what does that do to the platters and parts. The moisture alone is a big problem and can cause problems back to the Tower, or the person doing this.
Sorry! I keep forgetting that not everyone lives in the desert. Definitely don't do this in a humid environment, ever. And, yes, I consider it a last resort but have had good results. In the desert. D
/scott
p.s. I'll try dd_rescue before freezing another drive.
If you've not already killed that drive ) then I recommend you look at 'ddrescue', which is _not_ the same as the script 'dd_rescue'. ddrescue is a very different animal from dd_rescue and I've been a believer for a couple of years now. So much so that it's become a staple in work and in my training classes.
Cheers!
farmerdude
ewfacquire also has resume functionality (-R option). However the EWF format makes resume more complex than using (split) RAW. So it is slightly less probable the resume will succeed.
Thanks for the hint. I will give it a try!
Just re-read the OP and realized you are trying to image through USB. You may have far better results using the native interface of the drive instead (IDE or SATA).
If you've not already killed that drive ) then I recommend you look at 'ddrescue', which is _not_ the same as the script 'dd_rescue'. ddrescue is a very different animal from dd_rescue and I've been a believer for a couple of years now. So much so that it's become a staple in work and in my training classes.
Cheers!
farmerdude
www.onlineforensictraining.com
www.forensicbootcd.com
Agreed whole heartedly. Saved me a couple of times when all other software "got stuck" on some blocks that were starting to fail.