Hello,
I am new to the hardware part of forensics. I was at home with a drive I acquired to do some forensics on. It was a Maxtor drive 3.5 IDE with needed power to the drive. So I hook up a USB 3.5 IDE adapter and a seperate 5.0 V 4 pin power supply. the first time I do it, it works great and I aquire the image.
Later I got back to do it again. This time when I hook up the power supply to the drive the drive starts to smoke. I pull the power from the drive, but the drive is toast, literally.
What did I do wrong?
Thanks
Perhaps you plugged in the 4 pin power connector the wrong way round?
o
Moisture issue on the kitchen table? Or do you have a lab with anti-static mats, dehumidifiers, and all at home?
What did I do wrong?
Only you know what you did – we can only suggest possibilities. But everything you didn't do right needs to be examined for improvements. (See if you can find a Maxtor user guide on how to handle their disks – such guides usually contain lot of information that you need to know.)
Thought 1 How did you treat the drive prior to acquiry and after? Concerned about ESD? Could any externally available circuits have been contaminated or shorted? Did you damaged the disk?
Thought 2 How did you do acquiry? Some kind of live CD? Did you save the system log from the acquiry session along with the main data, so that any problems with device drivers or hardware detection can be identified? Any core dumps? (Disk faults may show up in minor things before they cause a HDD to fry.)
Thought 3 did you acquire S.M.A.R.T. parameters before and after main acquiry? Did they indicate that the drive was going marginal? If not, it's probably your handling of the drive that is at fault.
Thought 4 Did you check primary memory before and perhaps even after any acquiry (I'm assuming here that the computer you used is one you are unfamiliar with – which may not be true).
… and so on.
From my experience, it is from user error. I have seen countless times something being plugged in wrong or not in all the way and it toasts the drive or hardware device. My favorite is the boss who talks alot of smack and then fry's the evidence.
noahb2868 thanks for pointing out the obvious. If I didn't want it known that I did it I would have said that someone else fried the drive. Now, do you have any constructive comments on how I might not do it again?
Thanks
Since I have done the same in the past, the only thing constructive would be that in your kit, you either label or use velcro straps to keep your cables and devices together. This way, you can insure that you will not connect something to a device it does not belong to. Example, I have 10 different USB external drives. They all range in size from 80 to 320 GB. All of the cables should work with the devices. Ironically, they don't. Some are small and do not want to play nice. My trusty velcro straps. saved the day when trying to keep the cables together.
Also, was not trying to be a smart a*s. But we do kick ourselves….
noahb2868, thanks for the helpful information.
Sometimes these things just happen… Perhaps there was a manufacturing flaw in the drive controller and it was just a matter of time before it blew
noahb2868 thanks for pointing out the obvious. If I didn't want it known that I did it I would have said that someone else fried the drive. Now, do you have any constructive comments on how I might not do it again?
Thanks
Sure. Buy yourself a volt-ohm meter at Radio Shack and test the voltages of the connectors before you attach them to the drive. On the standard 4 pin Molex connector, the black should be the ground. The yellow is +12V, the red is +5V and the orange is +3.3. Check the voltage that you need to power the drive and for safety reasons, remove all others so that there is no chance that you'll accidentially cross-connect to a higher voltage.
I've seen cases where the pins on the jumpers have come out and been reinserted in the wrong positions. The easiest way to make sure that this doesn't happen is to make it impossible.
The other thing which is important, especially when you are dealing with smaller (2.5" and below) drives which don't have knock-outs that force you to connect in only one way, is to use cables and connectors which have been designed for forensic use. These are usually a little more expensive than your garden variety interface, but there is a good reason for that.