All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: Write Blocker for Linux flips upon encountering bad sectors
PostPosted: August 4th, 2015, 12:28 
Offline

Joined: August 4th, 2015, 12:20
Posts: 3
Location: The Matrix
Hi All,

Let's say for acquisition, "dc3dd" command is used and in the Linux system write blocker is implemented using udev rules.

Now I noticed that when dc3dd encounters a bad sector it flips the "acquiring" device from read only into read/write and tries to recover the bad sector and subsequently uses zero as the value for hash calculation.

Is it possible to prevent this occurrence? Is there any way it can be specified so that when bad sector is encountered, skip that sector and for hash calculation do not include that sector?

Thanks In Advance


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 5th, 2015, 2:43 
Offline
User avatar

Joined: May 3rd, 2011, 9:52
Posts: 178
Location: France
Hi,

I don't know if you can skip a bad sector but IMHO you should not do that.
Every forensic acquisition software I know fills bad sector with 0x00 (or any other pattern) and include them for the hash calculation.
The important thing is to log bad sectors and with what pattern they were filled, that way the process is reproducible and if you encounter the same bad sectors, the hash should be the same.

_________________
Lemmy


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 5th, 2015, 4:20 
Offline

Joined: August 4th, 2015, 12:20
Posts: 3
Location: The Matrix
Hi,

I am concerned because it changes the source to be read/write from read only in the process to try to write zeros into it.

Let's say we skip the bad sectors the calculated hash should be the same if for example the acquisition is done again since bad sector will always be a bad sector? (Not sure for this part though)

That's why wondering if it is possible to skip the bad sectors. But so far dc33d, dd and even guymager software all flips the read only when bad sector is encountered.

Not sure there is any other tool that can do acquisition without flipping.


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 5th, 2015, 5:13 
Offline

Joined: January 17th, 2010, 9:48
Posts: 60
Location: Stoke-on-Trent England
Perhaps you should try using a hardware write blocker.

Suggest you pick up one of these if your going to be doing a lot of forensic imaging mate
https://www.guidancesoftware.com/produc ... idges.aspx

_________________
DataWreck Data Recovery Services
www.DataWreck.co.uk


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 5th, 2015, 21:47 
Offline

Joined: August 4th, 2015, 12:20
Posts: 3
Location: The Matrix
Yes mate,

I think either hardware blocker or kernel patch to disable read/write permanently could be the last resort.

Seems like an OS issue, as I tried with dd, dcfldd and guymager and all showed the same phenomenon.


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 6th, 2015, 2:44 
Offline
User avatar

Joined: May 3rd, 2011, 9:52
Posts: 178
Location: France
Be carefull with hardware blocker and disks with many bad sectors.
They don't always behave as expected and can kill the disk.

_________________
Lemmy


Top
 Profile  
 
 Post subject: Re: Write Blocker for Linux flips upon encountering bad sect
PostPosted: August 16th, 2015, 2:52 
Offline
User avatar

Joined: February 13th, 2014, 12:13
Posts: 132
Location: Isfahan
Tableau tools are good, but I use SalvationData ( dead tool ) like as a hardware write-blocker in Linux.
One of the future you can set PIO/UDMA hardware switch and mix with dd_rescue with -r command.

_________________
Phoenix Computer Forensic Laboratory
http://www.databack.ir


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group