An official website of the United States government
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Issues with Imaging Drives Containing Faulty Sectors
Published
Author(s)
James R. Lyle, Mark R. Wozar
Abstract
In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. We found that investigators should be aware of some behaviors exhibited by the tools examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.
Acquisition of digital data, hard drive imaging, software testing, and testing forensic tools
Citation
Lyle, J.
and Wozar, M.
(2007),
Issues with Imaging Drives Containing Faulty Sectors, Digital Forensics Research Workshop, , USA, [online], https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=51226
(Accessed December 2, 2024)