I have just received a request to carry out a forensic recovery on a piece of vintage computing hardware: an IBM PS/2 8580 from 1987.
Despite my best efforts, I haven't managed to find a way of getting a forensic image of the hard disk onto some other media for examination and I'd be keen to hear if anyone can offer suggestions.
Here's the problem. The computer has a 70MB ESDI hard disk on a dediated ESDI controller so I can't take it out and install it in another PC. I can't install an IDE hard disk in the PS/2 because it doesn't have an interface. I can't install an interface because the motherboard uses MCA (microchannel architecture) rather than ISA/VLB/PCI and I can't find anyone who can supply me with an MCA IDE interface card.
For the same reason, I can't install a network card. Even if I could, it would have to be token ring and Encase (as far as I know) doesn't support accquisition over a token ring connection. I can't perform a parallel port accquisition with Encase 3.22g because, for reasons I can't discern, Encase will not connect to the PS/2 parallel port when the PS/2 is acting as the server.
I can't make an image to any removeable disk because the PS/2 only has a floppy drive and doesn't support any additional hardware of a suitable capacity to hold a 70MB image.
It goes without saying that the PS/2 does not have any USB ports and, in fact, it has only one serial port and one parallel port (which, from my results with Encase, I assume is non-standard in some way, although I'm drawing blanks trying to find out why).
Puzzler, isn't it? Any suggestions anyone?!? 😕
I'm open to pretty much anything at this stage. The accquisition doesn't have to be performed with Encase.
—–
Thomas K Moore
Director of Forensics & Investigative Computing
ICR Ltd.
Nottingham, UK
—–
I found a post on the Encase board referencing a setting in the BIOS for the parallel port. Will not work if the port is set to "unilateral". If this is the case try changing it to something else. Apparently you're ahead of the curve as most people posting about esdi drives couldn't get en.exe to run.
We have an old AuthenTec ‘flight server’ (days before Vogon) imaging machine from that era, it works on parallel ports. I have never used it, and don’t know how to use it, or if it would really work with ESDI disks. But if you research it, and think it might work you are welcome to borrow it. I think Paul Sanderson from
My solution would be….. and I know this may sound like a dumb idea but if all else fails – boot the machine to its OS and extract what you need to floppy disk. As long as you document everything, and be able to justify why you have breached the ACPO guidelines. Your explanation of what you have tried so far sounds very good and it seems you have been left with no realistic alternative.
Andy
'Solution' found! It's not ideal but it works and is sufficient in terms of procedure for this particular case.
Firstly, thanks for your input guys - not only was it helpful in terms of possible ways forward but it also provided me with reassurance that I wasn't missing something obvious!
I decided not to go down the route of getting hold of extra hardware on this particular occasion because of the small size and scope of the job, but thanks for the referral and I'll bear in mind Paul Sanderson if a similar situation crops up again.
So, to the 'solution'. I took the decision that I was going to have to boot the PS/2 up to it's operating system, which I was sure would be DOS and would, therefore, present limited risk to the drive contents. I then ran a forensic recovery utility to unerase deleted / formatted areas of the ESDI hard disk and had to save the recovered files back to the disk itself (usually a no-no but in this case, no other option).
Having done this, I connected the PS/2 to a second PC and used Laplink 3 to drag the recovered files over the parallel port, which *does* seem to work for Laplink (but not for Encase).
Like I say, not the perfect solution but, given the circumstances and the nature of the case, it should be sufficient.
Thanks again for your help guys! 🙂
Hi there.
We have a case, where we need to image a hard drive originating from a PS/2 laptop from the late 80'ties. The interface on the hard drive is an IBM "Micro Channel Architecture" MCA. as the case above. However, The laptop itsself is dead, so I can't access the hard drive via a Linux boot installation or any other way except taking it apart. Now, I'm looking for an adapter to convert the MCA to a more common output(IDE/(S)ATA).
Anybody out there, with a solution for me……
Cheers
Martin Warming
Senior Manager, KPMG Advisory
Perhaps you could find a similar vintage laptop on ebay?