Hi,
I have a question about a HDD I received from a friend. I've had to
ahead and fix it because they need the laptop back, so its kind of a hindsight question, but something I'd say that definitely pops up from time to time…
Bascially Windows XP (Very, very old laptop) would not boot and I am guessing the disk had bad sectors on it, as I plugged it into my PC and it came up and I could read it, but when trying to copy files off it, it just failed at random points.
She wanted some emails off it also, but I could not find the Inbox.dbx (Outlook Express) file, so I tried to put it through FTK, but that would also fail on reading the disk after a certain amount of time (about an hour) and it would basically hang and stop responding!
(Anyway, due to her pregnancy/impatience she needs it back, so I just formatting it… but dont think it will fix the problem in the long run…anyway!)
What I was mainly questioning is, I'm sure this type of problem comes up regularly, how would one go about reading the drive, considering it constantly fails and FTK (and assuming other tools) fail when trying to read the disk to get at and see the data from it?
Thanks.
A few months ago I had a case involving a laptop under a "preservation hold" that I was asked to image. Same results as your situation. FTK Imager ran as normal for a couple of minutes and quickly slowed to a crawl that would've had me waiting f-o-r-e-v-e-r.
I collected the drive, maintaining chain-of-custody, and brought it to my lab. None of my usual tools (testdisk, Acronis, et al.) worked. I found a great utility called
It ran for several days, but I was able to retrieve about 95% of the data from the drive that Disk Patch reported as being only '4% healthy.' The owner of the laptop had evidently smashed the drive against a hard surface in an effort to render it unreadable. He did not succeed. Sufficient evidence (lots!) was retrieved, proving his malfeasance in the case.
I love when that happens!
On the topic of bad sectors/clusters Encase (or whichever forensic imager) doesn't actually obtain a complete image of the HDD and leaves out bad sectors/clusters.
I remember back in 2001 a salesman visiting my offices and one of the products he had, from a known digital forensic vendor, was a data logger that recorded the certain activity (emails. passwords etc) and hid the data that had been randomly distributed across the HDD by marking sectors as bad; to be retrieved and the method of retrieval at the users choice. Given that the product wasn't paricularly expensive, it is quite possible people do use these types of products.
Given the scenario that forensic imaging does not read bad sectors, do you record that in your reports that the processes used may not have completely recovered all user data?
A tool that is worth a try in these cases is this one
DATARESCUEDD or DrDD (Freeware)
http//
http//
It has a "copy strategy" that tries to access data forward and backwards, which in some cases may get data otherwise inaccessible due to bad drive lock ups.
Mind you "recovery oriented", not "forensically oriented".
jaclaz
Thanks guys,
Some good info there, I will start by taking a look at some of the free stuff. I have just found another drive that I can not read, its a really old 12gb 2.5" IDE, its reading it for about 30 seconds, spinning, then stopping. Not getting enough time for the PC to pick it up as a drive! Nightmare!
I have just found another drive that I can not read, its a really old 12gb 2.5" IDE, its reading it for about 30 seconds, spinning, then stopping. Not getting enough time for the PC to pick it up as a drive! Nightmare!
This sounds like a drive needing a re-calibration (if possible at all) not something you will be able to attempt fixing with "normal" software, something like PC3000 is needed for (hopefully) fixing the firmware or access the drive at areally low level.
jaclaz
Thanks guys,
Some good info there, I will start by taking a look at some of the free stuff. I have just found another drive that I can not read, its a really old 12gb 2.5" IDE, its reading it for about 30 seconds, spinning, then stopping. Not getting enough time for the PC to pick it up as a drive! Nightmare!
Make sure that you are using a 40 pin cable, and not the normal 80 pin cable. We had lots of issues with older drives not liking our new cables quite a few years back.
Make sure that you are using a 40 pin cable, and not the normal 80 pin cable. We had lots of issues with older drives not liking our new cables quite a few years back.
With all due respect, if you used an 80 (or 40) pin cable on a 2,5" laptop HD I can tell you WHY the drive won't like 'em.
wink
mrgreen
jaclaz
This sounds like a drive needing a re-calibration (if possible at all) not something you will be able to attempt fixing with "normal" software, something like PC3000 is needed for (hopefully) fixing the firmware or access the drive at areally low level.
OK, just looked at the PC3000, looks like the right job! Some tool… however at around $5000 its kinda pricey for a printed circuit board! O
OK, just looked at the PC3000, looks like the right job! Some tool… however at around $5000 its kinda pricey for a printed circuit board! O
Well, what you actually pay for is not just the "printed circuit board" is the software and instructions/manuals (and the continuous upgrades to them) to solve specific HD problems as soon as they surface.
So, they aint't exactly cheap, but for a professional what I would also define as "an awful lot of money" is a "needed tool" and can be amortized in a few "solved cases".
Salvationdata has a similar toolkit
http//
http//
which appears to be a little more economical, I seem to remember in the US$ 2,400÷2,600 ramge, but still not exactly "cheap".
jaclaz