I am trying to acquire an image from a Samsung 80GB SV0802N IDE drive connected to a Tableau T35es. The drive will not get past 30288.75MB regardless of the program I use - FTK Imager, dcfldd, dd, or my favorite hex editor. I can see the drive contents from start to end, but acquiring it always fails. There is a 32GB limit jumper, but I've tried it with and without with no difference. It also doesn't make a difference if the drive is set to CSL or Master, but it isn't recoginzed through the Tableau if it is set to Slave. The drive won't even hash out - stops at the same point in the process.
I've tried the Tableau through both Firewire and USB.
There is a FAT32 primary from cyls 1-689 and a NTFS primary from cyls 690-10340.
I know I can get logical acquisitions or try doing a dd in manual segments, but I would rather get the whole thing raw or e01 if possible. Any ideas? I am thinking it has something to do with the 32GB limit option, but I don't understand why the jumper doesn't help.
I don't think the PC bios is an issue - it is a Dell T3500 with the latest and greatest and already has a 300GB SATA.
how much data is on the drive? maybe try doing it using a helix disc or something like that in the actual machine its from… it may well do it.
yup, i agree. Do try to boot up using Helix or any forensically sound linux boot disc and use linen for the acquisition. do update if or not that solves the problem. )
I know I can get logical acquisitions or try doing a dd in manual segments, but I would rather get the whole thing raw or e01 if possible. Any ideas? I am thinking it has something to do with the 32GB limit option, but I don't understand why the jumper doesn't help.
See if this tool helps ( going backwards wink )
http//
jaclaz
Get a PC with Linux and install dd_rescue, add the dd_rhelp-script and you are done.
It's amazing how many broken disks you can dump this way.
As you are using Tableau hardware, how does Tableau disk monitor report the disk ?