integrity verificat...
 
Notifications
Clear all

integrity verification of disk w/ bad sectors

4 Posts
4 Users
0 Likes
572 Views
(@bsims)
Posts: 1
New Member
Topic starter
 

Received a disk for imaging, and there is at least one bad sector - attempting to image it on a linux system, unable to get either an md5 or sha1 checksum of the original, as either dies when it gets to the sector it can't read. Imaging it w/ dd using conv=noerror,sync works just fine, but am at somewhat of a loss as to how to be able to verify the integrity of the image if I can't hash the original.

I don't imagine that this is an altogether uncommon problem, but the first I've ever encountered it. Any advice?

Thanks.

 
Posted : 01/03/2006 8:44 pm
(@youcefb9)
Posts: 38
Eminent Member
 

if the disk has a damaged cluster I dont see any problem considering the image you had as a matching replica of the original and you can generate md5 hashes or any other hashes from it (or from the disk).

if dd failed to read the bad sector then any other tool will fail the same and there is no magic behind it. the collected image could be presented as the best evidence possible and it's acceptable, in my knowledge, by all jurisdication out there.

 
Posted : 02/03/2006 4:12 am
farrahyde
(@farrahyde)
Posts: 21
Eminent Member
 

I have also encountered this with my current case. MD5 did not match due to bad sector(s), I would gather that more sectors failed during the dd process as there were less bits imaged as what was on origional to begin with. In accordance with this happening, when hard disk was reinstalled in orgional machine, it failed to boot properly. I noted that I had managed to ensure the best copy possible, then called a litigation expert… They confirmed that this would "more than likely" be acceptable. There's always that "grey" area ya know.

 
Posted : 02/03/2006 5:39 pm
(@bowneskg)
Posts: 7
Active Member
 

I am new to CF and still learning so apologies if this does not apply.

Is it possible the bad sectors are not really bad sectors but are hidden data?

http//www.forensicfocus.com/downloads/ntfs-hidden-data-analysis.pdf

This article relates to NTFS but is it possible to hide data on other file systems in sectors marked as bad?

 
Posted : 03/03/2006 4:15 pm
Share: