Hard drive acquisition problem

Try going into the Windows device driver control panel for the drive and force the drive back into PIO mode. It will be really slow, but might work.

There is a screen shot here about how to switch the Transfer mode between PIO and DMA
http//www.z-a-recovery.com/images/dma-mode.gif

I will give that a try on Monday when I return to work, but for now I must drink bourbon 😉

Thanks passmark

Which pin (which number) is missing on that disk?
Are you sure it is Pin 21?
If yes, this is typical of inserting the connector upside down, see
http//www.overclockers.com/forums/showthread.php?t=424783

Re-soldering/replacing the pin should be an easy (and "5 minutes") job.

BUT the "old school trick" wink was the following

1. cut the (remains of the) pin "almost level" with the black plastic of the HD connector (very slightly protruding)
2. get a pin (a "real" one) see pictures below (or a small brass plated nail) and cut it the right length so the you can insert it in the hole in the cable connector in such a way that it's head is touching the plastic of the cable connector, if needed use a small drill bit to allow some space for the pin head
3. put back the cable in the connector

[/listo]

http//images1.hellotrade.com/data2/DP/FJ/HELLOTD-1969633/picture_hook_and_48eb2df71bbcf-250x250.png
http//www.lcnail.com.tw/new/nail_coating2.jpg

jaclaz

Have you tried to work it through Linux? As another thought, (document it of course) boot into the computer and use FTK lite and do the imaging to an external drive??

If the drive works in the old machine then image it in that machine.

You may want to try booting a machine with a win95 boot disk that supports drive compression as many Win95 machines used the built in compression called DriveSpace which put the contents of the drive into a single compressed file that had to be decompressed on boot up by loading the drivespace driver.

Also, some of the older drives required that they be jumpered as a master with slave attached, or as Master Only in order for any bios to see them.

You may want to make sure you are using a 40 pin old style cable instead of the newer 80 pin cables.

Finally, some hard drives were married to the host machine bios and only the host machine could read them.

Not sure if any of that will help, just adding some thoughts from the "old" days.

Hi,

I would try a couple approaches to this problem, hopefully either should work.

You've mentioned the computer boots and the drive works fine in the original hardware but has no USB? I would

a) Add a USB card to the computer and boot it using DEFT CD (add CD Drive if necessary) and acquire using 'ewfacquire' via command prompt or

b) If you don't want to (or can't) add a USB card. Boot using the Guidance Software Knoppix 6.18 CD (available on their website). Connect a network enabled hard drive and acquire over a crossover cable using Linen (on the CD). You could also use DEFT and the network drive option using 'ewfacquire' (fastest IMO).

I have produced guides for both of the approaches for (b) - they work on standalone and servers alike. They are unfortunately too big to post here but can be grabbed from my Dropbox for a limited time (or if they have gone from there you can PM me).

If you need help with option (a) give me a shout and I can list the commands to set up the acquisition.

https://www.dropbox.com/sh/ue0fi3699x9mk40/_QD2OA8A9f

Hope this helps.

Shep

Thanks for the suggestions and help guys, there is a serious amount of old school knowledge floating around here.

This is the approach I'm going to take, and if neither of these work then I will look at other avenues. I'm very reluctant to try soldering another pin in place as this is a clients hard drive, it currently works with his computer and if I start soldering away there is a chance I could make things worse, i have big hands and not the steadiest for that kind of thing.

I've got EnCase V4 (no dongle required) and the matching boot floppy. Once I find a floppy disc and crossover cable I'll boot using the floppy then try a network acquisition.

If that fails I've got a Pata CD drive and Pata HDD, I'll install Win 98 on my PATA drive, slave off the original drive and then boot with UBCD with FTK imager and grab it that way.

If both of those fail then I'll try other things

Edit - Just thought I'd let you know what worked. The Floppy boot disc didn't work possibly due to faulty floppy drive on the machine, or cable, or controller on motherboard. So I attached a pata cd rom and luckily I had a bood CD with the old EnCase 3, 4 and 5 on it. Boot from CD with crossover cable and I'm away. Imaging local drive that way. Thanks again for the suggestions and help, it's good to have such a broad range of knowledge and experience to draw on when needed.