I'm a freshman in forensic computing and till now I always made a e01 disk images on worked on them. However my blocker went down some time ago and even though I ordered a new one it hasn't arrived yet. Thus I went to some data recovery company asking them to make a copy. What they said to me is they would rather make a byte-to-byte copy than an image. I agreed. Important thing is that the SSD drive might have been formatted before it was sent to me.
I wanted to image a 160GB SSD drvie to a 640GB SATA drive. I returned home with the disks and now have a problem. When I connected the SATA drive to my laptop the system sees the device with unpartitioned space only and it reports that this space amount to 0.6 GB, which is the size of the SATA. So where's the 160GB image???
I got stuck - how can I tell which part of 0.6GB belongs to the imaged SSD drive? Can I somehow make a standard image file from that? What would you advise?
! Your question has a few layers, so, rather than try to explain them it would be better for you to develop a foundation from which to understand the answers you may get in this forum. You might start by reading through, and practicing concepts in, File System Forensic Analysis by Brian Carrier. I would be surprised if it isn't required reading in your academic program.
Hope this helps,
Scott
What is the file system on the drive?
Run your forensic software, and open the drive they gave you.
I can guess what your problem is, but I suspect if you answer the above question you should have enough to move on.
It's NTFS drive I believe as the company used Windows 2000 as their system. As it reports only the unpartitioned space it's hard to say.
I'm using X-Ways Forensics at the moment and simply started searching for partitions (it's gonna take a while….)
Have you learned how to parse an MBR and VBR yet?
If the external company did as they said, then the first 160GB of your SATA drive should be the same as the SSD drive you gave them.
If you plug in your SSD drive it may also only show 0.6GB of data.
You need to compare sectors on both the SSD and SATArive to see if the copy was made correctly.
If you are worried about the write blocker - you could drive a software USB blocker. They can work - but the one I tried once write blocked ALL USB drives which is not how I wanted to work.
As Tony said, look at the MBR etc etc. You need to undrstand many key parts of the disk and not just rely on software tools.