Reading the dead disk

I and Nick Pringle were in the forensics lab going through some old hard drives which were reported as faulty (unreadable, bad sectors, etc). We selected one that sounded quite used (if you give it a shake it sounds like a shaker) and put it through the recently acquired Disk Data Recovery Tool Set, PC-3000[1].

After booting and running a few diagnostics on the drive we found that one of the 8 heads was reporting a fault. We were able to access some information so we copied it to a separate folder and disconnected it from PC-3000. We then tried to image the drive with Encase [2]. After 5 minutes in the imaging process the drive made an awful squeaking noise followed by a few clicking noises. The drive did not sound too well.

It would seam that two things could have happened. 1) Encase worked too hard on the drive while imaging and the drive died. 2) We were lucky on the first run and retrieved the information and simply the drive died once pushed to its limits (inevitable).

We have still to see how well the PC-3000 kit handles other drives with similar problems. Overall I think that it works quite well and provides a lot of control over the drive. I am not sure though that it will be useful in cases where the drive has to be forensically sound and unaltered.

Links:

[1] ACE Laboratory, PC-3000, http://www.pc3000.com/

[2] Encase, http://www.encase.com/ 

This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Your email address will not be published. Required fields are marked *