Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.

Https

The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Issues with Imaging Drives Containing Faulty Sectors

Published

Author(s)

James R. Lyle, Mark R. Wozar

Abstract

In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. We found that investigators should be aware of some behaviors exhibited by the tools examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.
Volume
4
Issue
Supp. 1
Conference Title
Digital Forensics Research Workshop

Keywords

Acquisition of digital data, hard drive imaging, software testing, and testing forensic tools
Created September 1, 2007, Updated February 17, 2017