Notifications
Clear all

Hard Drive Issues  

  RSS
Chiprafp
(@chiprafp)
New Member

Ladies and Gents,

We are having some issues with 2TB+ drives when it comes to using them as destination drives for imaging via bridge. We will initially format the drive using GPT and then image the suspect drive, once we return to the lab though if we try to connect the drive to the forensic workstation via our dock or usb3 caddy it will pop up stating that the drive needs to be formatted before use.

The only way around it is to use the original bridge we used when acquiring the drive, in which case it instantly picks up the drive and proceeds as normal.

Anybody got any reasons this may be happening or have a solution to it after having the same problems?

Thanks for any assistance you may be able to offer )

Quote
Posted : 06/09/2013 4:03 pm
hc4n6
(@hc4n6)
New Member

What are you using to format the drive in the first place? I would recommend using Tableaus Forensic Duplicators, then when prompted select GPT. This will create two partitions, one 2 TB partition and one 1 TB partition. If the space runs out in the first one, imaging will continue in the second one.

Windows 7 shouldn't have any issues detecting these 2 partitions.

ReplyQuote
Posted : 06/09/2013 4:34 pm
Chiprafp
(@chiprafp)
New Member

We have currently just been formatting using a windows format and selecting GPT. We are having this issue with 2TB drives not just 3TB.

ReplyQuote
Posted : 06/09/2013 5:56 pm
jaclaz
(@jaclaz)
Community Legend

It is very possible that the controller in the "USB3 caddy" has some issues with GPT (or with the disk size).
It was not so "strange" a few years ago to get one of those (USB 2) external enclosures to find that the controller in it had a limit on 128 Gb, and there has been a similar "artificial" limit for some time around 1 Tb.

There is no real need to make a GPT partition on a 2 Tb disk, as the "conventional" MBR partitioning is valid up to (32 bit addresses) 2^32 = 4,294,967,296 sectors * 512 = 2,199,023,255,552 bytes.

The actual OS used (both while partitioning/formatting the disk and when attempting to mount/access it) could also be part of the issue.

Just as an example, a number of operating systems (including seemingly Windows 7) are compatible with a "stretched" setup with MBR covering up to nearly 4 Tb (in 2 around 2 Tb partitions).
http//www.rodsbooks.com/gdisk/workarounds.html
So, if you are using Windows 7 you could still use MBR on larger than 2 Tb disks.

jaclaz

ReplyQuote
Posted : 06/09/2013 8:14 pm
Chiprafp
(@chiprafp)
New Member

Many thanks guys this gives us some things to look at back in the office next week!

ReplyQuote
Posted : 07/09/2013 4:27 pm
jaclaz
(@jaclaz)
Community Legend

Many thanks guys this gives us some things to look at back in the office next week!

Good )
Keep an eye on this "spin-off" thread, also
http//www.forensicfocus.com/Forums/viewtopic/t=10971/

jaclaz

ReplyQuote
Posted : 07/09/2013 4:43 pm
Share: