How to forensically...
 
Notifications
Clear all

How to forensically image a 2Tb External HDD

13 Posts
6 Users
0 Reactions
4,310 Views
(@simarno)
Active Member
Joined: 8 years ago
Posts: 11
Topic starter  

3.5" spinning one


   
ReplyQuote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
 

Sorry got the wrong end of the stick.

Do you have multiple imaging machines? Can you try it on another one?
What software are you using to image the disk?


   
ReplyQuote
(@jahearne)
Eminent Member
Joined: 9 years ago
Posts: 35
 

I would do it two ways if you have the time and resources.

First is to take the NAS unit and direct attach it to your workstation and grab an image before you take it apart and break it - just in case! Image it first direct attached. In Windows you can use diskpart to disable automount. Carefully document your steps no matter what procedure you use.

Depending on the model of the NAS unit, you can take it apart and the image the drive(s) individually. Most of them are simple, RAID-0 stripe usually 64kb or 512kb, XFS or EXT4 file system. But some are 1/2 kb stripe or a span. Don't even mess with a Drobo! And some WDs have an encrypted bridge.

Good luck,


   
ReplyQuote
Page 2 / 2
Share: