I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?
Â
Thank you!
What drive is that? Model number? What imaging tool are you using? What is the exact error message you get?
When you say 'target driver' going into sleep mode, what are you referring to? Another disk? Model and make for that?
Why should it go into sleep mode? That typically happens when no commands/data appear within T seconds, but no imaging situation I can think of should trigger that, and if it does the drive should recover to normal mode reasonably gracefully. Can you check that idea? When does that drive go into sleep mode? What does the HDD data sheet say about that?Â
Can you test reading and writing separately? That just read from the source drive without writing, and just write to the destination driving without reading? If either doesn't work, you at least know where the problem is. Or have you used the destination drive before, and you know that it works OK?
Are you powering everything adequately? Can you check?
You're not using Windows with some weird power plan that decides that since there's no user activity, it must reduce power to drives?
I spoke with another examiner who said that this occurs due to the target driver going into sleep mode.
So, he/she was familiar with the problem and was able to diagnose it but provided no solution or workaround?
Â
Is there anyway to stop this from occurring in a forensically sound manner?Â
Or did he/she suggested a non-forensically sound solution or workaround?
jaclaz
What tool are you using and on which platform?:)
Does that tool produce a log with the error message?
And last but not least, are you a 100% certain that it is due to the disk going to sleep and not due to a disk failure?
/LeGioN
Are you sure it is not the input drive going to sleep or failing?Â
Is it possible to read more than a few GBs from this driveÂ
Is either drive doing many retries - you can normally hear this, or feel it by holding the drive.
Have you tried imaging to a different drive?
It's more likely that the drive is failing.
I've had more success with hardware imaging solutions with failing drives, tableau or similar.
Â
Also:
If you can get hold of X-Ways Forensic, their imager can run an image from back to front of the drive, it might give you a route to an image.
I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?
Â
Thank you!
Have you checked the power settings on the computer and changed them to hard drives never sleep or hibernate?
Â
Maybe his own hard drive has now failed 😉Â
Is this a Green Drive? The Green Drives are supposed to be lower powered drives that stop when the drive senses it is not being written to. If this is, you will need to adjust your Imaging process. If you have a TD1 or TD2, you can do this in the interface. If you are attempting to image it via computer, try using XWay imager, or something else that can throttle the speed of the drive
@mjpetersen A green drive will not go to sleep whilst imaging. After 5 minutes rest, maybe, but imaging is continuous. One of the drives I think has a hardware issue. One needs to determine if it is the reading drive, or the written to drive.