All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 29 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Data Extractor Imaging question
PostPosted: March 31st, 2017, 19:57 
Offline

Joined: March 9th, 2017, 6:16
Posts: 18
Location: trinidad
I want to know what type of data sectors copying is recommended ---
1) Imaging
2) Cloning to another Target directly

I would like to know advantages and disadvatages of both methods. Imaging is what I do ,I have never done cloning which could be faster than imaging.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: March 31st, 2017, 20:17 
Offline

Joined: March 9th, 2017, 6:16
Posts: 18
Location: trinidad
I forgot to mention , here I am talking about task creation in pc3000 Data Extractor.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 1st, 2017, 8:54 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 7539
Location: Portugal
Advantages of imaging :

- You can have multiple image files inside one drive. If you have a destination drive that have 1TB you can place there several images of smaller drives. If you have to image 5 x 80 GB drives then you can place those images on a single drive. With cloning you would need 5 destination drives.

- Using logic data recovery software like R-Studio, GetDataBack, etc on the image files normally is faster then scanning the clone. You can open the image file and extract data to the same drive as well as long as you have enough space. On a 1 TB drive you can have the image file of the 80 GB drive and extract the data of that image with R-Studio (as files) to the same drive where you have the image.

- Cloning is just usefull when you have minimal damage or you don't have damage at all on the initial drive and you need to make a "copy" tha will directly work on the client machine. Meaning you want to replace one drive with another new one and you don't need/intend to do logic recovery so you clone the drive to the new one and if it's not damaged you just replace the old one with the new and it should work as long as you don't have copy protection stuff locked to the serial number or model of the drive...

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 1st, 2017, 8:57 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 7539
Location: Portugal
Please also read here - http://www.hddoracle.com/viewtopic.php? ... 1410#p7243

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 2nd, 2017, 8:51 
Offline
User avatar

Joined: June 27th, 2005, 8:27
Posts: 587
Location: India
I would recommend do target based.
Example. Scan MFT. Mark needed data. Save data.

Cloning is done where drive condition is not so good and you can't get file structure and data can be full disk.

Vikas Seth

_________________
DF :)
www.datatracksystem.net


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 2nd, 2017, 9:19 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1493
Location: Providence, RI
I used to always do drive to drive cloning, and I know many professionals still prefer that method. However I've found that there are some advantages to using image files. For example:

1. It saves time wiping clones. Unless you're always getting 100% imaged (never going to happen), you always need to fully wipe clone drives before reuse as the unread sectors will contain remnant data from previous cases and that's a security risk as this data can be picked up during logical scans of data recovery software. Since DE image files are unread sector aware via the map file, you can simply delete the img files when your done to make room for more images.
2. Saves time connecting/disconnecting clones. I've got a 32TB RAID in my system so I always just dump the images there unless it's a big drive (4Tb+) in which case I'll still use a drive to drive clone.
3. Less issues with destination drives going bad. Before using individual drives I regularly had them go bad on me as most consumer grade drives aren't built for the amount of abuse we put them through. Now I'm running all HGST enterprise SAS drives in a RAID 6, so it's up to the task of moving around a TBs of data every single day.

There are also some disadvantages. For example, if it's a Mac hard drive and in ends up that it had filevault encryption you end up having to move the image to a physical drive anyway so you can move it over to a Mac and decrypt the data.

_________________
Hard Drive & RAID Data Recovery Services
https://www.data-medics.com/raid-data-recovery/


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 6:32 
Offline

Joined: March 9th, 2017, 6:16
Posts: 18
Location: trinidad
Hello
Thank you vikas ,spildit and data-medics

All of your views are correct. Imaging or direct cloning both has some advantages and some disadvantages.
Right option should be used as per case requirement.
As data-medics has pointed out , in case of encrypted drives , direct disk to disk cloning is better option.
spildit is also right - in case of severely damaged drive imaging is better,
Thank you for shading light on the subject. :)


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 8:04 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 1851
Location: Ontario, Canada
Although there is a lure to the image to file when possible, it becomes an issue when you get to a certain volume of projects a month. If you are doing a few projects a week, you may be able to have enough storage to hold all the images in a RAID. But, what happens when you starting doing 50-100TB of recoveries a week, with a minimum of 2 week retention? Yes, you save some space with images of drives that are not full, but that only goes so far.

So, I guess I'm one of the guys who generally stays with drive-to-drive clones. I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process. As I might only have one kick at the can, I'm going to be ready for whatever comes my way. I also like the flexibility to be able to move the recovery to another system, if needed.

As for having to wipe drives, it isn't much of an issue. We can connect many drives to a single system and have the wipe through the night.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 8:45 
Offline

Joined: August 18th, 2010, 17:35
Posts: 2996
Location: Massachusetts, USA
Drive-to-drive cloning here, too. Primarily due to flexibility to move the clone to other systems.

_________________
Hard Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 9:05 
Offline

Joined: November 29th, 2006, 10:08
Posts: 6771
Location: UK
Drive-to-drive here too :-)

_________________
PC Image Data Recovery
www.pcimage.co.uk


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 9:10 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 2595
Location: Greece
Drive to image files here :)

_________________
Northwind Data Recovery - Greece
WD Trusted Partners
http://www.northwind.gr


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 13:31 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2125
Location: CDRLabs @ Chandigarh [ India ]
Drive to drive here

_________________
Regards
Amarbir S Dhillon
CDRLabs Data Recovery - [ Chandigarh ,India ]
My Data Recovery Experiments - > https://www.facebook.com/chandigarhdatarecovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 14:03 
Offline
User avatar

Joined: December 19th, 2006, 8:49
Posts: 7539
Location: Portugal
Drive to image and if required later image back to new drive here.

_________________
1Q9xrDTzTddUXeJAFRn37aqh1Yr6buDCdw - (Bitcoin Donations)
The HDD Oracle - Platform for OPEN research on Data Recovery.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 14:51 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 230
Location: Kolding | Denmark
+1 for drive 2 drive 8)

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 16:06 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 1851
Location: Ontario, Canada
As I see it...all the smart guys and Amarbir go drive-to-drive...everyone else is just wrong. ;) <---- this is meant to be funny, for those of you who take offense.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 16:08 
Offline

Joined: May 21st, 2007, 16:10
Posts: 1402
Location: Gothenburg/ Sweden
Drive 2 Drive here as well :D

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 17:10 
Offline

Joined: February 16th, 2016, 21:07
Posts: 27
Location: Boston, USA
lcoughey wrote:
I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process.

Well I wrote a tool I call DataMap for this purpose. It is not perfect but I find it useful to quickly guesstimate how full of data a raw drive is by taking a small number of data samples. It is also good for finding the starting sector of lost partitions.

Here is an example of a 500GB HP notebook drive with 4 partitions. In this case I set DataMap to divide the drive into 48 blocks then sample 32 bytes from each block. The resulting map shows the drive is about 60% empty which fairly matches reality.

Code:
[======DISK======] [=============NAME==============] [====SIZE====]
[sda             ] [Hitachi HTS72755               ] [   465.76 GB]

[=====DEVICE=====] [==FILESYS==] [======LABEL======] [====SIZE====]
[sda1            ] [ntfs       ] [SYSTEM           ] [   300.00 MB]
[sda2            ] [ntfs       ] [<unknown>        ] [   443.66 GB]
[sda3            ] [ntfs       ] [HP_RECOVERY      ] [    16.80 GB]
[sda4            ] [vfat       ] [HP_TOOLS         ] [     5.00 GB]


Image

_________________
On-Line Data Recovery Consultant. RAID / NAS / Linux Specialist.
Serving clients worldwide since 2011
FreeDataRecovery.us


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 10:07 
Offline

Joined: October 13th, 2008, 7:29
Posts: 1479
Always drive to drive cloning. It takes a bit of time wiping the clones but it is by far the best method for recovery and it also free's up the PC3000 systems when needing to extract the data.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 15:07 
Offline

Joined: December 16th, 2015, 12:37
Posts: 62
Location: Qatar
Drive to image ...
why i need to image all the drive if its only few GB's off data !!!


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 16:26 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 230
Location: Kolding | Denmark
@H13 no need to image all drive, select only needed data and image drive 2 drive.
@HDD Spaz i always use DE to save data, you can run many DE processes in work with copy only. Not limited to number of PC3K ports. (dest. drive is of course not connected to PC3K port)
@lcoughey nothing wrong with image to file 8) works great, i just like to keep things separated. Also keeps a destination drive for 30 days together with patient, if a case needs to be reopened.

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 29 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Google [Bot] and 24 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group