What do you mean with "the logical copy of the content"? Do you mean just what you see in Window Explorer once you put the cd into the pc?
Heh … Not quite, because I'd only trust Windows Explorer as far as I could throw it ( while installed ) - but basically the logical file system, rather than the physical media.
I guess I've been lucky and not had many damaged discs to image, I can't for the life of me remember the last time I couldn't … Someone else may be better positioned to advise then !
conv=noerror means if there are errors dcfldd will not abort but will write zeros for that sector
This is from here. You can set dfcldd to skip errors and to write zeros … I was sure that I'd done it before ! -P
in this period i must acquire many cd & dvd i do this with encase but often there are many errors and so encase is not a good idea…..
EnCase does not 'do' anuthing with the CD reader if there is an unreadable sector, the CD typically does the usual N attempts to reread that sector (where N can be 128 or something), and when the drive eventually returns to Encase with a failure, Encase seems to try the whole thing again.
Check up CloneCD from Slysoft. It can reconfigure your CD reader to give up after two or three failures, and to skip some number of sectors and replace them with 0 (i.e. very much like EnCase). It records session structure in a separate .cue sheet, and if I recall, the .ccd image can be dragged straight into EnCase for analysis.
When I compared Encase and CloneCD on a very poor CD, I had to stop EnCase after three hours, while CloneCD was finished in five minutes. Yes, there were lots of read errors on the CD, but you want that information first, as well as what files are affected before you go back in and try to retrieve any important files. You don't want to wait for three hours and still not know what acquiry status really is.
I'm not sure if ISObuster reconfigures the drive to handle read errors more gracefully if it doesn't, there will be no change from EnCase.
i know the problem linked with a multisession disk….but i spoken of the problem linked with damaged CD/DVD because for example is too much old or deteriorated so with many tools i know how recover a good % of this damaged files but my doubt is " if i hash the recovered files/folder wich valence have this hash? an expert versus me, can contest this hash is irripetible? because i think if i repeat these operations after one months probably i can recover i different % of files and so a different value of hash…
i hope to have used the correct word for this concept
P.S. thank you to all people that answer at this post
In a poor word i do not have dubt with which tools i must use to acquire there are many and many tools….but i have many dubt about how i must do for a correct procedure of hash what and how i need to hash…
Your hash won't prove that your image is correct, merely that it hasn't changed. Given proper documentation, and appropriate understanding of the issues, I see no good reason that a true expert would be able to refute your evidence as being somehow wrong.
I've run into the damaged CD (it looked like the laser had been sitting on one area of the CD for too long or something - the recording matrix was actually damaged under the plastic) issue and used dd_recue to make an image both forward and reverse to pickup the areas that were readable. We then carved out the files.
The hashes with a damaged CD will never be the same because one drive will be able to read some of the bad areas and another drive may not.
It is common to get areas of a disk as blank - between different sessions. These will 'read' as failed sectors. These are not actually failed, just never written to
There can also be areas on RW disks, typically where the first session was longer than the second where there will be bad sectors.
As for hashing. Decide on a method an document it. It should be repeatable though this could be difficult on disks that have partially failed, and different drives will read a different number of sectors
It is actually common for CD/DVD images to give different hashes when imaged multiple times. CD-DVD Forensics from Syngress is an excellent reference on the topic.