Imaging of Damaged Devices

Introduction

Imaging is probably the most common task for any data recovery and forensic professional.

They spend all their working days creating disk images and screening blocks on a display.

They know perfecly how Hard Disk Drives are critical and they are aware that the more sectors they read from a device the more data will be recoverable.

Rocket has been created to be the best hard drive imaging tool ever.

Why Imaging is important in Data Recovery

In a Device Analysis Task you cannot figure the complete status of device.

Probably in a fast test you will analyze only a small part of lba surface, the File System Metatata and the root node.

You cannot be sure 100% Patient Drive will survive to Data Recovery Process.

Do exist many cases where a perfect working patient crashed during the surface reading, and without a clone or any disk image your work will result useless.

Imaging or cloning really is also low cost task.

You need only a spare set of secure erased devices for your cloning tasks.

For Best Data Recovery Results create a cloning or imaging Task of damaged device IN EVERY CASE.

Hint

Creating a clone or an image of a damaged device means reading damaged blocks once. this reduces damaged device stress and risks of internal catastrophic damages.

Data Recovery Basic Concepts

If you are recovering a damaged device, you should taste current disk status and plan the right data recovery strategy.

Do exist devices so critical or so slow that a complete image cannot be performed, or do exist devices where File System has severe corruption and files and folders cannot be analyzed from the original source.

You should be aware that if a device area is corrupted, reiterating reading retries could be catastrophic.

First Surface Analysis

Start an imaging or cloning task of source device and check Lba Map and reading progress.

If performances are good and reading process gives you the chance to read 2.000.000 lbas without errors probably hard drive has reading heads and surfaces in good status.

If you find many errors, break your Task and from Reading Options set Start Lba value to middle of device size.

Continue checking several areas of device.

If you found several contiguous green areas you can restart from 0 and proceed to a complete reading of device.

If you found several contiguous long yellow areas probably you are facing a bad heads drive or a large lba corruption case.

If you found only yellow areas probably device has some firmware error and need fixing.

First Pass Reading Process

Start your Reading Process with a High Error Tolerance to gain the max possible Lbas and reduce devices stress on damages areas.

  1. Create a Clone or Image Task
  2. On Options Error Tab Set Jump Value to 100000 Lbas
  3. On Options Error Tab Set Jump After Consecutive Errors Value to 1 Lbas
  4. On Options Error Tab Disable Retry Skipped Sectors
  5. On Options Error Tab Disable Perform Operations After Jump
  6. Press Start Button

Hint

Always Monitor Reading Task and Device Performance. If Device encounters a critical area, consider stopping task and read from a different offset editing start lba value on Options Reading Tab.

This reduces damaged device stress and catastrophic internal damages.

Second Pass Reading Process

Second Reading Pass will reduce skipped blocks and optimize data recovey results.

Clearing Map Skipped Blocks

  1. From Rocket Menu Locate Lba Map Functions
  2. From Options Set Start Lba to 0 and Max Lba to Default Value
  3. Clear Lba Map Skipped Sectors

Starting Second Pass Reading

  1. On Options Reading Tab Set Block Size Value to 8 Lbas
  2. On Options Error Tab Set Jump Value to 20000 Lbas
  3. On Options Error Tab Set Jump After Consecutive Errors Value to 1 Lbas
  4. On Options Error Tab Enable Retry Skipped Sectors
  5. On Options Error Tab Enable Perform Operations After Jump
  6. Press Start Button

Hint

In most of damaged heads cases, skipped area will have the same range on the whole LBA area.

_images/readingerrors.png
Picture:Damaged BLock on LBA MAP

Final Stage Reading Process

Final Stage Reading Pass will result in the best possible data result.

Clearing Map Skipped Blocks

  1. From Rocket Menu Locate Lba Map Functions
  2. From Options Set Start Lba to 0 and Max Lba to Default Value
  3. Clear Lba Map Skipped Sectors

Starting Final Stage Reading

  1. On Options Reading Tab Set Block Size Value to 8 Lbas
  2. On Options Error Tab Set Jump Value to 1024 Lbas
  3. On Options Error Tab Enable Retry Single Sectors
  4. On Options Error Tab Enable Retry Skipped Sectors
  5. On Options Error Tab Enable Retry Skipped Block
  6. On Options Error Tab Enable Perform Operations After Jump
  7. On Options Error Tab Set Jump After Consecutive Errors Value to 2 Lbas
  8. Press Start Button