How to locate the s...
 
Notifications
Clear all

How to locate the s/n ...

7 Posts
6 Users
0 Reactions
521 Views
(@rickgarcia76)
New Member
Joined: 14 years ago
Posts: 2
Topic starter  

I need some assistance. I am dealing with a piece of original evidence which (obviously) can not be tampered with. It is a 2.5" internal hdd housed in a generic external enclosure. No S/N is available on the enclosure. Usually in this situation, either a Tableau physical write-blocker or FTK imager 9properties view) will display the S/N - but neither of these are working in this case.

Does anyone know of an app or utility which may be able to assist me in locating the the S/N of the internal hdd w/out having to open the enclosure?

Thanks,
Rick


   
Quote
4n6art
(@4n6art)
Reputable Member
Joined: 18 years ago
Posts: 208
 

Have you tried Tableau Disk Monitor?
http//www. tableau. com/index.php?pageid=products&model=TSW-TDM

-=Art=-


   
ReplyQuote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

This is for Windows Win32_PhysicalMedia class


   
ReplyQuote
(@bithead)
Noble Member
Joined: 20 years ago
Posts: 1206
 

Looks like WD and Seagate among others have their own utilities that show S/N.


   
ReplyQuote
Ricco
(@ricco)
Trusted Member
Joined: 15 years ago
Posts: 52
 

HDDScan shows more then you need
http//hddscan.com/


   
ReplyQuote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

Does anyone know of an app or utility which may be able to assist me in locating the the S/N of the internal hdd w/out having to open the enclosure?

It should be present in the IDENTIFY DEVICE response from an ATA or ATAPI device – but I would expect that that is where Tableau would get it from, and as you say it doesn't … it may not be there.

You don't say anything about how this enclosure interfaces to the computer USB? Firewire?

In general, Ultimate Boot CD is a good resource – but it may not work for USB or FW-connected devices. (That goes for some other utilities – they may assume xATA connection.)

If you have and are reasonably familiar with some forensic boot CD based on Linux, try 'hdparm -I /dev/sda'. (or whatever device you're using).

Alternatively, the udevadm, as in '/sbin/udevadm info –query=property –name /dev/sda' (or whatever device it is) and look for 'ID_SERIAL_SHORT'.

Both those commands are worth closer examination, as they can provide lots more information about examined drives.


   
ReplyQuote
Passmark
(@passmark)
Reputable Member
Joined: 14 years ago
Posts: 376
 

Any tool with display SMART data should also display the serial number,
http//en.wikipedia.org/wiki/S.M.A.R.T.
http//en.wikipedia.org/wiki/Comparison_of_S.M.A.R.T._tools

If connected via USB, the problem however is that some USB enclosures have USB to IDE bridge chips that prevent some commands being translated from USB to IDE. In which case you won't be able to get the data.


   
ReplyQuote
Share: