HDD imaging problem

i have 1TB 3.5" SATA ST31000524NS hdd to clone. first i tried disk to disk duplication with TableAU …

A bit unspecific. What exact tool were you using? And perhaps also, how did you connect the respective disks to it? Pure SATA?

… . what might cause this? bad sectors on source drive?

Depends … mainly on what tool / product you were using. It's how *that* tool behaves in the presence of bad sectors that would answer your question. But we don't know what tool you used

So … What tool are you using that doen't tell you what errors occur during acquiry?

If it's a tool for disk duplication … well, don't expect anything else than 'disk duplication failed source/destination disk bad'. Disk duplicators are seldom interested in too many details.

If it's a tool for forensic acquiry, there is often a way to configure it to skip bad sectors if they appear, and then produce a report of what such skips have been performed. But you don't seem to have any explicit report to go on, only an observation that imaging speed appeared to decreae to 0.

k i have log from ftk imager

NOTICE The imaging operation was cancelled! This image is incomplete!

Created By AccessData® FTK® Imager 3.4.0.1

Case Information
Acquired using ADI3.4.0.1
Case Number 1
Evidence Number
Unique Description
Examiner
Notes

————————————————————–

Information for E\EXTRACTION\dell3020

Physical Evidentiary Item (Source) Information
[Device Info]
Source Type Physical
[Drive Geometry]
Cylinders 121,601
Tracks per Cylinder 255
Sectors per Track 63
Bytes per Sector 512
Sector Count 1,953,525,168
[Physical Drive Information]
Drive Model ST310005 24NS USB Device
Drive Serial Number 90E75FFFFFFF
Drive Interface Type USB
Removable drive False
Source data size 953869 MB
Sector count 1953525168

ATTENTION
The following sector(s) on the source drive could not be read
342999808 through 359907583
The contents of these sectors were replaced with zeros in the image.

Drive Model ST310005 24NS USB Device
...
Drive Interface Type USB
USB enclosures are bad at handling bad sectors (this means they may report tons of sectors as bad when a single bad sector is encountered), try to connect the drive directly to your imaging computer. Also, avoid using hardware write blockers for the same reason.

Make sure you're using the absolute latest version of FTK Imager from here though I doubt that'll sort it.

Agree with other suggestions to make sure your physical interface is up to scratch, swap out cables and so on.

Since it's a Seagate drive, grab SeaTools and give it a poke to see if it's dying. You might like to play around with a non-evidential drive with this software first if you're not familiar with it since it can do some fairly low level stuff to drives.

k i have log from ftk imager

So let's look at it …

Physical Evidentiary Item (Source) Information
…
[Physical Drive Information]
Drive Model ST310005 24NS USB Device
Drive Serial Number 90E75FFFFFFF
Drive Interface Type USB
Removable drive False
Source data size 953869 MB
Sector count 1953525168

First off, you were asking about a SATA drive. The information in here suggests that USB is also involved. This adds to the driver complexity USB can be fickle. If the Tableau device you mentioned (but haven't identified) is an USB device this might refer to it – in which case, the question of drivers and/or firmware may arise. Simply put, is it up to date?

But as it also clearly shows that you were using FTK, it changes your question

ATTENTION
The following sector(s) on the source drive could not be read
342999808 through 359907583
The contents of these sectors were replaced with zeros in the image.

Your question, then, is really 'Why does FTK fail to read sectors off the disk?'

In your specific case, I would examine system event logs for error messages concerning this disk from the operating system for any additional information.

In general it is because a read request failed, and the HDD responds that it was not able to read the requested sector. (There may be other reasons – any system logs will show if that's the case). It could be due to hardware failure (the HDD is damaged), it could be to fakery (the disk isn't really 1 Tb, but only pretends to be), it could be driver problems, cabling problems, software problems, power problems, and so on. Some of these may be possible, and perhaps even easy to eliminate, but there is not information enough for me to do so.

If this is an USB-powered device, however, I hope you powered it independently to ensure it was fully powered. If not, that might be a source of problems – but as I'm not familiar with this particular device, I can't say for sure. You have to check how much power it needs, and evaluate if your method of powering it was sufficient to meet those needs.

(If you're not familiar with computer hardware troubleshooting, try to find a decent book – the one I used many years ago is probably out of print, but a search on Amazon for 'Troubleshoot repair your own PC' produces a number of hits. Older books can be OK to use if you're using an older computer. I'd stay away from suspiciously short books, though, and I may prefer books that are reference books rather than basic and introductory – but that's me. I remember buying half-a-dozen of these books before I found one that fitted me. Other posters may have suggestions here.)

As the first failed sector (342999808) is not a binary 'even' number, I suspect hardware problem to be likely, and, assuming you've checked things like power problems etc., disk damage is the most likely. The next problem is probably to determine to what extent the disk is damaged, and if it is possible to retrieve additional information from other parts of it.

I might also want to use the manufacturer's diagnostic tools to perform additional test of the health of the drive.

However, it also raises the question of how exactly the disk has been damaged, and if you are increasing the damage by trying to read from it (or even run the diagnostics), as well as how that would affect the task you are trying to achieve.

Assuming this is a professional job, … it becomes a question of if you have an HDD recovery expertise (as you asked in this forum, I suspect not) or if you need to hand the disk over to someone who does.

If you just need the HDD to be forensically imaged, I'm sure we can accommodate for an affordable price. We're not a forensics company, we're in data recovery, but we have equipment such as PC-3000 which can image a drive with bad sectors to an Encase file for you.

I can't promise that every last sector will be read, as some may actually be bad, but we'll certainly be able to read more than you can with any software tool.

Short of using a hardware imaging tool like PC-3000, your best bet would be to use ddrescue as already suggested or even HDDSuperTool / HDDSuperClone in Linux. But, I'm not sure that either is exactly forensically sound as they don't generate the proper checksums.