A damaged hard drive, especially when it comes to evidence drives, requires a complex imaging approach to avoid the drive’s further deterioration and data loss. TaskForce system enhances your working with damaged evidence drives, minimizing the risk of losing data on the working part of the head stack.
Diagnostics and selective head imaging
TaskForce’s built-in drive diagnostics module automatically checks all subsystems of the evidence drive. At the end of the diagnostics process, it provides a clear and detailed report about its electronics and motor, head stack, media surface, firmware and file system.
In the Heads section of the diagnostics report, TaskForce forensic imager provides detailed information about the state of each head. In addition, it offers the recommendation of the optimal imaging strategy for your damaged hard drive.
The above diagnostics report informs the operator that the drive’s hardware has major issues and points to defects in the media and a damaged head (Head#3). The report recommends that the damaged head is disabled in the imaging settings so that the good heads can be imaged first.
Atola engineers recommend imaging the good heads first. The system will prompt you to disable the bad head when you attempt to image the drive.
Alternatively, click the Image category in the left-side menu, select your source and target devices, click Continue. When you get to the Settings page, click Change to adjust the settings for your imaging session. In the Settings screen’s What to Image section, click on All sectors to configure the selective imaging.
Unselect the damaged head, Click Save and then click the Start button to launch your imaging session.
Multi-pass imaging of bad sectors
As the imaging session is running to its end, you can see that errors have been found on the space of the drive that is read with the Head#4. It is common for a drive with a bad head to also contain errors on the platters that are read with other heads.
When encountering a bad sector that belongs to a good head, TaskForce uses its multi-pass imaging algorithm to handle the errors and attempt retrieving data from the bad sectors upon completing the imaging of good sectors. To read more about the multi-pass imaging system, please follow this link.
When the selective imaging (from the good heads) is complete, the system pauses the imaging session and produces a detailed Imaging report that includes a log of all actions performed throughout the imaging session.
TaskForce automatically creates reports for every single action applied to each device connected to it. The reports are stored in the case management system.
Attempting to image the bad head
Having successfully retrieved data from the good heads of the damaged head evidence drive, you have two options:
- Replace the head stack before you get down to imaging the remaining data. Please, keep in mind that data on the drive can become unreadable due to head stack replacement;
- Try imaging data with the Degraded or Damaged head. To image the unselected bad head, simply click Resume.
Atola TaskForce resumes the imaging session and focuses only on the area that belongs to the damaged head. Depending on the severity of the damage, it will safely retrieve as much data as possible or will be skipping the unreadable sectors and log them in the imaging report.
When imaging the damaged head, pay attention to the progress. If the number of errors keeps growing, while the number of the imaged sectors remains unchanged, it is safe to assume that the head will not be able to read more sectors.
In such a case, it is advisable to pause the imaging and power down the drive to avoid more potential damage to the platters with the bad head.
In the Imaging report you can see that TaskForce imaged 520,961,167 sectors out of 625,142,448, having extracted as much data from good heads as possible. TaskForce’s Segmented hashing functionality helps you verify the data on the evidence drive with the image, even if not all data was retrieved.
Now you can evaluate how critical the remaining data on the drive may be based on the data retrieved from the good heads. You may already have sufficient evidence. Alternatively, you can choose to bring the drive to a cleanroom, where the drive’s head will be replaced. Then you will be able to image the areas belonging to the replaced head.
This imaging strategy helps you save time by imaging the data from the good heads and avoid causing more damage to the media.
For more details about the successfully imaged sectors and those that failed to be imaged, scroll down the report and check the Log.
- How to benefit from the range of sources and targets in Atola TaskForce - November 10, 2020
- Imaging RAID 0 array - August 13, 2020
- Damaged drive imaging with TaskForce: A drive with a damaged head - July 9, 2020