All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 26 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Data Extractor Imaging question
PostPosted: March 31st, 2017, 19:57 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
I want to know what type of data sectors copying is recommended ---
1) Imaging
2) Cloning to another Target directly

I would like to know advantages and disadvatages of both methods. Imaging is what I do ,I have never done cloning which could be faster than imaging.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: March 31st, 2017, 20:17 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
I forgot to mention , here I am talking about task creation in pc3000 Data Extractor.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 2nd, 2017, 8:51 
Offline
User avatar

Joined: June 27th, 2005, 8:27
Posts: 615
Location: India
I would recommend do target based.
Example. Scan MFT. Mark needed data. Save data.

Cloning is done where drive condition is not so good and you can't get file structure and data can be full disk.

Vikas Seth

_________________
DF :)
www.datatracksystem.net


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 2nd, 2017, 9:19 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
I used to always do drive to drive cloning, and I know many professionals still prefer that method. However I've found that there are some advantages to using image files. For example:

1. It saves time wiping clones. Unless you're always getting 100% imaged (never going to happen), you always need to fully wipe clone drives before reuse as the unread sectors will contain remnant data from previous cases and that's a security risk as this data can be picked up during logical scans of data recovery software. Since DE image files are unread sector aware via the map file, you can simply delete the img files when your done to make room for more images.
2. Saves time connecting/disconnecting clones. I've got a 32TB RAID in my system so I always just dump the images there unless it's a big drive (4Tb+) in which case I'll still use a drive to drive clone.
3. Less issues with destination drives going bad. Before using individual drives I regularly had them go bad on me as most consumer grade drives aren't built for the amount of abuse we put them through. Now I'm running all HGST enterprise SAS drives in a RAID 6, so it's up to the task of moving around a TBs of data every single day.

There are also some disadvantages. For example, if it's a Mac hard drive and in ends up that it had filevault encryption you end up having to move the image to a physical drive anyway so you can move it over to a Mac and decrypt the data.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 6:32 
Offline

Joined: March 9th, 2017, 6:16
Posts: 103
Location: trinidad
Hello
Thank you vikas ,spildit and data-medics

All of your views are correct. Imaging or direct cloning both has some advantages and some disadvantages.
Right option should be used as per case requirement.
As data-medics has pointed out , in case of encrypted drives , direct disk to disk cloning is better option.
spildit is also right - in case of severely damaged drive imaging is better,
Thank you for shading light on the subject. :)


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 8:04 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
Although there is a lure to the image to file when possible, it becomes an issue when you get to a certain volume of projects a month. If you are doing a few projects a week, you may be able to have enough storage to hold all the images in a RAID. But, what happens when you starting doing 50-100TB of recoveries a week, with a minimum of 2 week retention? Yes, you save some space with images of drives that are not full, but that only goes so far.

So, I guess I'm one of the guys who generally stays with drive-to-drive clones. I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process. As I might only have one kick at the can, I'm going to be ready for whatever comes my way. I also like the flexibility to be able to move the recovery to another system, if needed.

As for having to wipe drives, it isn't much of an issue. We can connect many drives to a single system and have the wipe through the night.

_________________
Luke
Recovery Force Data Recovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 8:45 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3636
Location: Massachusetts, USA
Drive-to-drive cloning here, too. Primarily due to flexibility to move the clone to other systems.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 9:05 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7843
Location: UK
Drive-to-drive here too :-)

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 9:10 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
Drive to image files here :)

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 13:31 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
Drive to drive here

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 14:51 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 601
Location: Kolding | Denmark
+1 for drive 2 drive 8)

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 16:06 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
As I see it...all the smart guys and Amarbir go drive-to-drive...everyone else is just wrong. ;) <---- this is meant to be funny, for those of you who take offense.

_________________
Luke
Recovery Force Data Recovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 16:08 
Offline

Joined: May 21st, 2007, 16:10
Posts: 1592
Location: Gothenburg/ Sweden
Drive 2 Drive here as well :D

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 5th, 2017, 17:10 
Offline

Joined: February 16th, 2016, 21:07
Posts: 43
Location: Boston, USA
lcoughey wrote:
I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process.

Well I wrote a tool I call DataMap for this purpose. It is not perfect but I find it useful to quickly guesstimate how full of data a raw drive is by taking a small number of data samples. It is also good for finding the starting sector of lost partitions.

Here is an example of a 500GB HP notebook drive with 4 partitions. In this case I set DataMap to divide the drive into 48 blocks then sample 32 bytes from each block. The resulting map shows the drive is about 60% empty which fairly matches reality.

Code:
[======DISK======] [=============NAME==============] [====SIZE====]
[sda             ] [Hitachi HTS72755               ] [   465.76 GB]

[=====DEVICE=====] [==FILESYS==] [======LABEL======] [====SIZE====]
[sda1            ] [ntfs       ] [SYSTEM           ] [   300.00 MB]
[sda2            ] [ntfs       ] [<unknown>        ] [   443.66 GB]
[sda3            ] [ntfs       ] [HP_RECOVERY      ] [    16.80 GB]
[sda4            ] [vfat       ] [HP_TOOLS         ] [     5.00 GB]


Image

_________________
On-Line Data Recovery Consultant. RAID / NAS / Linux Specialist.
Serving clients worldwide since 2011
FreeDataRecovery.us


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 10:07 
Offline

Joined: October 13th, 2008, 7:29
Posts: 1493
Always drive to drive cloning. It takes a bit of time wiping the clones but it is by far the best method for recovery and it also free's up the PC3000 systems when needing to extract the data.


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 15:07 
Offline

Joined: December 16th, 2015, 12:37
Posts: 94
Location: GCC
Drive to image ...
why i need to image all the drive if its only few GB's off data !!!


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 16:26 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 601
Location: Kolding | Denmark
@H13 no need to image all drive, select only needed data and image drive 2 drive.
@HDD Spaz i always use DE to save data, you can run many DE processes in work with copy only. Not limited to number of PC3K ports. (dest. drive is of course not connected to PC3K port)
@lcoughey nothing wrong with image to file 8) works great, i just like to keep things separated. Also keeps a destination drive for 30 days together with patient, if a case needs to be reopened.

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 7th, 2017, 17:44 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
For those who image to file, what kind of storage do you have connected to your PC 3000?

_________________
Luke
Recovery Force Data Recovery


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 9th, 2017, 3:30 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3464
Location: CDRLabs @ Chandigarh [ India ]
lcoughey wrote:
For those who image to file, what kind of storage do you have connected to your PC 3000?


Hee Hee ,
Luke Now Thats Going To Be a Hard Drive " Most Possible In RAID Setup " :mrgreen:

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com


Top
 Profile  
 
 Post subject: Re: Data Extractor Imaging question
PostPosted: April 9th, 2017, 9:39 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 2003
Location: Providence, RI
I've got 8x 4Tb HGST SAS Enterprise drives in a RAID 6 (so 24Tb effective). Along with an Areca 1880i controller. It's enough to keep all the smaller images for at least two weeks. Bigger drives such as a full 4Tb I'll still image out to a single drive. I'm actually considering adding another external RAID to it for more storage, but haven't gotten to it yet.

I usually image by bitmap unless I can't get a full read of the MFT or expect to be looking for deleted data for some other reason, so that significantly cuts down the size of the image files. Expecially when it's a 4Tb that only has 200Gb actually used on it.

_________________
Data Medics - Hard Drive, SSD, and RAID Data Recovery Service Company


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 26 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 60 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group