Authors: James R. Lyle (National Institute of Standards and Technology), Mark Wozar (National Institute of Standards and Technology)
DFRWS USA 2007
Abstract
In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. Investigators should be aware of some behaviors exhibited by the tools that we examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.