Interesting situation, hard drive which has good image on it, except that I need to copy that image to another drive and every method of copying is hanging up on one of the 200 files. I've tried every copy program I know of Terra, ultra, Forensiccopy, Windows, etc.
It loads up in FTK Imager and the structure is all fine. What's the best and quite possibly fastest way, since the drive may go at any time to get that image to another drive?
I thought back in the day there was some Encase 4 Acquisition trick where you loaded up the image and then copied it out by making another image to a new location. However, I'm worried that the one trouble file which gets to 99% BTW will not allow for a new image.
It would be nice if I could get all those image files over to a new drive and or let that .1% issue be ignored.
Any suggestions?
Is it a single image, split up into 200 separate files?
What is the image format?
Do any of the copy programs throw an error of any sort?
Did you try moving the drive to a different machine, in case it isn't the drive at fault?
I might have been off on the 200, but over 100.
Single image in 2GB chunks
No error, just hangs for a day.
5 different machines all hang on that one file.
Even using copy programs I could copy parts 1-150 then 151 hangs, 152-200 are fine.
No chance of reimaging
Is it a single image, split up into 200 separate files?
What is the image format?
Do any of the copy programs throw an error of any sort?
Did you try moving the drive to a different machine, in case it isn't the drive at fault?
I would use my method of Incremental Imaging to create an image of the problem disk.
This will help produce a workable copy that will not hang, but you may end up with a corrupted file to handle.
Hi,
Long shot, but have you tried making an LEF or AD1 of the EO1 files then see if they then 'copy out' uncorrupted to an new location? Other than that, as you state you can get it into FTK, I would mount the image and take a logical image of the mounted drive. Some evidence is better than none if the drive is on its way out? Good luck, had an image fail once and caused no end of headaches.
Regards Shep
Had this a few times over the year. I would open drive in encase… and then copy the errant file off using that.
This has worked for me - but of course different problems can produce the same effect so ymmv.
What about using FTK Imager to "convert" the image to another drive?
First thanks for all the replies
Sorry I might
Not have spelled it out correctly.
If I have an image consisting of 1.eo1 through 10.e01. and it's hanging on 8.e01 I can't remove the offending file, because I don't know what it is.
I thought maybe I load it in encase acquisition and then acquire that image? I'm thinking I did something like that years ago.
Thanks again for all replies
Have you tried verifying the image? (not necessarily germaine, but might be telling).
You said it loads in FTK Imager, so I would use that to create a new image from it to a new location.
If the disk is failing, you might be SOL. Maybe make an image of the failing disk (ddrescue) and extract the evidence image from the disk image.
If I am understanding your question correctly, that is.
So load it in FTK imager, create disk image, what am I creating a disk image of it's not a file (image a file option), it's not a physical disk, because there are other things on that disk as well as deleted items, other images, etc.
Thanks for the reply.
Have you tried verifying the image? (not necessarily germaine, but might be telling).
You said it loads in FTK Imager, so I would use that to create a new image from it to a new location.
If the disk is failing, you might be SOL. Maybe make an image of the failing disk (ddrescue) and extract the evidence image from the disk image.
If I am understanding your question correctly, that is.