extremely slow acquisition with FTK Imager

Do you require the compression?

I mean, compression is normally linked to the lack of infinite storage space in most organizations, but if you are doing a recovery work you can most probably just acquire to a drive the same size. That could possibly speed up the process.

I would try 2 Gb chunks as well, for instance.

I would try it without the USB converter. One step less in the chain, perhaps it helps.

Do you require the compression?

I mean, compression is normally linked to the lack of infinite storage space in most organizations, but if you are doing a recovery work you can most probably just acquire to a drive the same size. That could possibly speed up the process.

I would try 2 Gb chunks as well, for instance.

We actually tested this theory a while back and running the higher compression resulted in a faster acquisition almost every time.
But, I did try 0 compression and 2GB chunks too.. none, if any, speed increase.
I have not tried eliminating the adaptor yet.

Larry

bad sectors on the hdd?

Do you have any other tools you can try?

If you have access to Xways try imaging the drive in reverse as DD (not sure what other tools can reverse image but there are bound to be some out there).

bad sectors on the hdd?

Do you have any other tools you can try?

If you have access to Xways try imaging the drive in reverse as DD (not sure what other tools can reverse image but there are bound to be some out there).

I am sure there are bad sectors.
It just angers me when the software writers haven't resolved problems like this in the 14 years that I have been in forensics.. but, I am not a programmer either.
I may try a linux distro, or two, but other than that, no.

I have never used Xways but I have heard good things and I may end up purchasing it… especially if it can do a reverse acquisition…
THey may be the ones that have solved this bad sector issue.

10 hours, 61,657KB so far..

I say not only bad sectors, bad firmware.

Easy fix for the most part, if you have the right machine and software.

it's a highend Windows 7 64bit computer 32GBs RAM and my HDD is SATA going through a SIIG USB3 converter.

Check that you have connected the USB3 converter to an USB3 connector. That is, make sure you know what types your connctors are. If you haven't, you may be working on an USB 2.x or even an 1.x connector. Or you may be working with a connector or a hub that for some reason falls back to compatbility mode, because you're not using USB3 cables. (Don't trust the connector.)

And if you aren't using separate power to the USB unit, check that the power requirements do not exceed what you're delivering.

Also check the physical hard drive – if you're out of luck you may be trying to image a device that has built-in encryption. Those drives are slower than 'normal' drives, and there's nothing you can do to speed it up. HDD spec sheets usually say how fast .

Compute power is of fairly small importance here (unless you compress, which you probably should avoid if you can), it's throughput that matters.

This is an area where it pays to experiment with your setup – do short acquiry tests using different USB connections, different cables, different software, Keep track of time and amount of data – what does *your* USB3 setup do in terms of throughput? What happens when you add encrtption – does it speed things up or slow them down? Can the disk keep up with the rest of the system, or will it be the bottleneck? If you have some kind of antivirus running, what happens if you turn it off – does that speed things up? And you're not indexing the acquired files/segments, are you? Are you using some kind of disk encryption?

Windows gives you a lot of opportunities to see what the system actually is doing – get familiar with the Resource Monitor and watch it for CPU, disk and I/O activity in general.

I am sure there are bad sectors.

Is it a guess, or are you getting reports from the acquiry tool that it fails on some sectors? If you suspect the drive to be bad in any way, have you run any diagnostics? Does the SMART information tell you that the number of remapped sectors is excessive? Or anything?

Assuming the problem is just bad sectors, what is the behaviour of your chosen imaging tool on bad sectors – does it tell you about it? where? (Do you get them in the system event log, for example?) And does it skip ahead past a chunk of sectors that are likely to fail too, or does it just grind away on the next sector?

It just angers me when the software writers haven't resolved problems like this in the 14 years that I have been in forensics.. but, I am not a programmer either.

I believe there are a number of reasonable solutions. It's just that they're not being given away for free. DeepSpar, for example, seems to do things right.

However, as far as I can see from the postings, you don't know where the problem is. Whatever you do, don't just switch to another imaging program, another USB converter, etc unless you have good reason for it. If there is a problem, you need to be able to identify it. For example, the easist way to identify that it is the disk, is to do a test acquiry with exactly the same set up, except with a disk that is known to work. If that works, you can fairly safely point at the the HDD and say that it caused it. (It could also be the interface between the disk and the USB converter, though.)
And then it's not a straight imaging job anymore, it's turned into a data recovery job. You need the apporpriate tools for that kind of job.

It sounds as if the disk drive is failing. There is probably nothing wrong with your USB etc configuration.

If a sector fails, the drive will try and read it again, and again, and again. If you physically pick the drive up, you will probably feel the heads moving a lot.

My solution is to image the drive in sections ( http//www.cnwrecovery.com/html/incremental_imaging.pdf ). By doing this find areas of the disk that will read without problems - typically the end, and then fill in the earlier, problem sectors later.

The warning is that the drive could fail fatally at any point, and so the more stress by extra reading is not good news.

The other approach is discuss with a drive hardware repair company about possible head replacement.

The approach were a software routine tries to repair a drive bad sectors is controversial as it does stress the drive, and can cause fatal damage.