When using a cloning utility such as DDI, do you always let it clone the entire Source drive.

For instance, if the data from the source drive appears to stop transferring at 36% - will you just let it run on until the scan reaches 100 % in the chance it might find some data fragments in unallocated space? Or will you just stop the scan?

Did you select all the data via DRE and confirm that no sectors were being used beyond that point? It is not uncommon for the MFT to have a secondary location at the middle of the drive...as well as more data there.

For us, we do our best to target data first, just to be sure that we have the critical files, then we go back and get the remainder of the drive cloned. If you don't do a full mirror and your client comes back to say that something is missing, you will be screwed...unless you keep the original drive.

My personal experience is, if you cut corners to get the job done faster, it will come back and take 10 times longer to finish.

_________________
Luke
Recovery Force Data Recovery

+1

_________________
Secarma Ltd
http://www.secarma.co.uk

+2

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se

Agree with you here, and would like to add:

sometimes clients requests FULL Clone ( no matter what ) coz they have installed some sort of 3rd. party application server and wanted it AS IS
to save some $$$$ installing/configuring servers back again.

and sometimes we have to repair some minor OS booting in order to get it back working as before.

all depends on clients requests.

right?>

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein