I need some assistance. I am dealing with a piece of original evidence which (obviously) can not be tampered with. It is a 2.5" internal hdd housed in a generic external enclosure. No S/N is available on the enclosure. Usually in this situation, either a Tableau physical write-blocker or FTK imager 9properties view) will display the S/N - but neither of these are working in this case.
Does anyone know of an app or utility which may be able to assist me in locating the the S/N of the internal hdd w/out having to open the enclosure?
Thanks,
Rick
Have you tried Tableau Disk Monitor?
http//www. tableau. com/index.php?pageid=products&model=TSW-TDM
-=Art=-
This is for Windows
Looks like
HDDScan shows more then you need
http//hddscan.com/
Does anyone know of an app or utility which may be able to assist me in locating the the S/N of the internal hdd w/out having to open the enclosure?
It should be present in the IDENTIFY DEVICE response from an ATA or ATAPI device – but I would expect that that is where Tableau would get it from, and as you say it doesn't … it may not be there.
You don't say anything about how this enclosure interfaces to the computer USB? Firewire?
In general, Ultimate Boot CD is a good resource – but it may not work for USB or FW-connected devices. (That goes for some other utilities – they may assume xATA connection.)
If you have and are reasonably familiar with some forensic boot CD based on Linux, try 'hdparm -I /dev/sda'. (or whatever device you're using).
Alternatively, the udevadm, as in '/sbin/udevadm info –query=property –name /dev/sda' (or whatever device it is) and look for 'ID_SERIAL_SHORT'.
Both those commands are worth closer examination, as they can provide lots more information about examined drives.
Any tool with display SMART data should also display the serial number,
http//
http//
If connected via USB, the problem however is that some USB enclosures have USB to IDE bridge chips that prevent some commands being translated from USB to IDE. In which case you won't be able to get the data.