It just occurred to me that under the right circumstances, a destination SMR HDD might be an explanation.
But as the OP (@jayt4049) seems to have abandoned the subject, there seem to be little but random speculation left.
I have a 1TB Western Digital hard drive I am attempting to image. After about 30 seconds the imaging stops and and says it fails to image, aside from about 1.5GB. I spoke with another examiner who said that this occurs due to the target driver going into sleep mode. Is there anyway to stop this from occurring in a forensically sound manner?
Â
Thank you!
DeepSpar's Guardonix does a great job of maintaining a connection with 'sleepy' drives, plus a lot of other features dealing with bad drives in general.Â
I'm giving a Guardonix away this month that you can enter (free) at https://www.dfir.training/guardonix-giveaway . Actually open to everyone to enter.
@bshavers Deepspar's stuff is always so expensive, this is no exception.
$615 or $1085 for a write blocker and not many reviews about it at all.
Expensive, granted. But to be fair, this one does more than just block writes. It does very well at recovering data from bad sectors and optionally keyword searches while imaging (sort of a pre-triage using any list of words).Â
As for the price, I wouldn't spend that much for a write blocker that only blocked writes, but for a write blocker that might eliminate the need of sending a drive off for data recovery of bad sectors....the ROI is made on the first drive that recovers more than what any other write blocker can do.
Plus, one person will be getting a Guardonix for free on July 17 🙂