Skip to main content
U.S. flag

An official website of the United States government

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Issues with Imaging Drives Containing Faulty Sectors

Published

Author(s)

James R. Lyle, Mark R. Wozar

Abstract

In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. We found that investigators should be aware of some behaviors exhibited by the tools examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.
Volume
4
Issue
Supp. 1
Conference Location
, USA
Conference Title
Digital Forensics Research Workshop

Keywords

Acquisition of digital data, hard drive imaging, software testing, and testing forensic tools

Citation

Lyle, J. and Wozar, M. (2007), Issues with Imaging Drives Containing Faulty Sectors, Digital Forensics Research Workshop, , USA, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=51226 (Accessed May 18, 2024)

Issues

If you have any questions about this publication or are having problems accessing it, please contact reflib@nist.gov.

Created August 31, 2007, Updated October 12, 2021