Lyle, J.
and Wozar, M.
(2007),
Issues with Imaging Drives Containing Faulty Sectors, Digital Forensics Research Workshop, , USA, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=51226
(Accessed April 18, 2024)
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Issues with Imaging Drives Containing Faulty Sectors
Published
Author(s)
,
Abstract
In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. We found that investigators should be aware of some behaviors exhibited by the tools examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.Volume
4
Issue
Supp. 1
Conference Location
, USA
Conference Title
Digital Forensics Research Workshop
Pub Type
Conferences
Download Paper
Keywords
Acquisition of digital data, hard drive imaging, software testing, and testing forensic tools
Citation
Created August 31, 2007, Updated October 12, 2021