WD HDD going to sle...
 
Notifications
Clear all

WD HDD going to sleep while imaging  

  RSS
Jayt4049
(@jayt4049)
New Member

I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?

 

Thank you!

Quote
Posted : 30/05/2020 1:02 pm
athulin
(@athulin)
Community Legend

What drive is that?  Model number?  What imaging tool are you using?  What is the exact error message you get?

When you say 'target driver' going into sleep mode, what are you referring to?  Another disk?  Model and make for that?

Why should it go into sleep mode? That typically happens when no commands/data appear within T seconds, but no imaging situation I can think of should trigger that, and if it does the drive should recover to normal mode reasonably gracefully. Can you check that idea?  When does that drive go into sleep mode?  What does the HDD data sheet say about that? 

Can you test reading and writing separately?  That just read from the source drive without writing, and just write to the destination driving without reading?  If either doesn't work, you at least know where the problem is. Or have you used the destination drive before, and you know that it works OK?

Are you powering everything adequately?  Can you check?

You're not using Windows with some weird power plan that decides that since there's no user activity, it must  reduce power to drives?

ReplyQuote
Posted : 30/05/2020 2:26 pm
jaclaz
(@jaclaz)
Community Legend
Posted by: @jayt4049

I spoke with another examiner who said that this occurs due to the target driver going into sleep mode.

So, he/she was familiar with the problem and was able to diagnose it but provided no solution or workaround?

 

Posted by: @jayt4049

Is there anyway to stop this from occurring in a forensically sound manner? 

Or did he/she suggested a non-forensically sound solution or workaround?

jaclaz

ReplyQuote
Posted : 30/05/2020 3:40 pm
LeGioN
(@legion)
Member

What tool are you using and on which platform?:)
Does that tool produce a log with the error message?
And last but not least, are you a 100% certain that it is due to the disk going to sleep and not due to a disk failure?

/LeGioN

ReplyQuote
Posted : 31/05/2020 11:13 am
mscotgrove
(@mscotgrove)
Senior Member

Are you sure it is not the input drive going to sleep or failing? 

Is it possible to read more than a few GBs from this drive 

Is either drive doing many retries - you can normally hear this, or feel it by holding the drive.

Have you tried imaging to a different drive?

ReplyQuote
Posted : 31/05/2020 1:43 pm
Jon_C
(@jon_c)
New Member

It's more likely that the drive is failing.

I've had more success with hardware imaging solutions with failing drives, tableau or similar.

 

Also:

If you can get hold of X-Ways Forensic, their imager can run an image from back to front of the drive, it might give you a route to an image.

ReplyQuote
Posted : 17/06/2020 11:12 am
armresl
(@armresl)
Community Legend
Posted by: @jayt4049

I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?

 

Thank you!

Have you checked the power settings on the computer and changed them to hard drives never sleep or hibernate?

 

ReplyQuote
Posted : 19/06/2020 1:51 am
Rich2005
(@rich2005)
Senior Member

Maybe his own hard drive has now failed 😉 

ReplyQuote
Posted : 19/06/2020 8:59 am
mjpetersen
(@mjpetersen)
New Member

Is this a Green Drive? The Green Drives are supposed to be lower powered drives that stop when the drive senses it is not being written to. If this is, you will need to adjust your Imaging process. If you have a TD1 or TD2, you can do this in the interface. If you are attempting to image it via computer, try using XWay imager, or something else that can throttle the speed of the drive

ReplyQuote
Posted : 30/06/2020 6:26 pm
mscotgrove
(@mscotgrove)
Senior Member

@mjpetersen  A green drive will not go to sleep whilst imaging.  After 5 minutes rest, maybe, but imaging is continuous.  One of the drives I think has a hardware issue.  One needs to determine if it is the reading drive, or the written to drive.

ReplyQuote
Posted : 30/06/2020 10:47 pm
athulin
(@athulin)
Community Legend

It just occurred to me that under the right circumstances, a destination SMR HDD might be an explanation.

But as the OP (@jayt4049) seems to have abandoned the subject, there seem to be little but random speculation left.

ReplyQuote
Posted : 01/07/2020 6:39 pm
bshavers
(@bshavers)
Active Member
Posted by: @jayt4049

I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?

 

Thank you!

DeepSpar's Guardonix does a great job of maintaining a connection with 'sleepy' drives, plus a lot of other features dealing with bad drives in general. 

I'm giving a Guardonix away this month that you can enter (free) at https://www.dfir.training/guardonix-giveaway . Actually open to everyone to enter.

ReplyQuote
Posted : 03/07/2020 7:22 pm
armresl
(@armresl)
Community Legend

@bshavers  Deepspar's stuff is always so expensive, this is no exception.

$615 or $1085 for a write blocker and not many reviews about it at all.

ReplyQuote
Posted : 04/07/2020 6:35 am
bshavers
(@bshavers)
Active Member

Expensive, granted. But to be fair, this one does more than just block writes. It does very well at recovering data from bad sectors and optionally keyword searches while imaging (sort of a pre-triage using any list of words). 

As for the price, I wouldn't spend that much for a write blocker that only blocked writes, but for a write blocker that might eliminate the need of sending a drive off for data recovery of bad sectors....the ROI is made on the first drive that recovers more than what any other write blocker can do.

Plus, one person will be getting a Guardonix for free on July 17 🙂

ReplyQuote
Posted : 04/07/2020 7:11 am
Share: