Data Extractor Imaging question

[bunty]

I want to know what type of data sectors copying is recommended ---
1) Imaging
2) Cloning to another Target directly

I would like to know advantages and disadvatages of both methods. Imaging is what I do ,I have never done cloning which could be faster than imaging.

[bunty]

I forgot to mention , here I am talking about task creation in pc3000 Data Extractor.

[darkforce1]

I would recommend do target based.
Example. Scan MFT. Mark needed data. Save data.

Cloning is done where drive condition is not so good and you can't get file structure and data can be full disk.

Vikas Seth

[data-medics]

I used to always do drive to drive cloning, and I know many professionals still prefer that method. However I've found that there are some advantages to using image files. For example:

1. It saves time wiping clones. Unless you're always getting 100% imaged (never going to happen), you always need to fully wipe clone drives before reuse as the unread sectors will contain remnant data from previous cases and that's a security risk as this data can be picked up during logical scans of data recovery software. Since DE image files are unread sector aware via the map file, you can simply delete the img files when your done to make room for more images.
2. Saves time connecting/disconnecting clones. I've got a 32TB RAID in my system so I always just dump the images there unless it's a big drive (4Tb+) in which case I'll still use a drive to drive clone.
3. Less issues with destination drives going bad. Before using individual drives I regularly had them go bad on me as most consumer grade drives aren't built for the amount of abuse we put them through. Now I'm running all HGST enterprise SAS drives in a RAID 6, so it's up to the task of moving around a TBs of data every single day.

There are also some disadvantages. For example, if it's a Mac hard drive and in ends up that it had filevault encryption you end up having to move the image to a physical drive anyway so you can move it over to a Mac and decrypt the data.

[bunty]

Hello
Thank you vikas ,spildit and data-medics

All of your views are correct. Imaging or direct cloning both has some advantages and some disadvantages.
Right option should be used as per case requirement.
As data-medics has pointed out , in case of encrypted drives , direct disk to disk cloning is better option.
spildit is also right - in case of severely damaged drive imaging is better,
Thank you for shading light on the subject.

[lcoughey]

Although there is a lure to the image to file when possible, it becomes an issue when you get to a certain volume of projects a month. If you are doing a few projects a week, you may be able to have enough storage to hold all the images in a RAID. But, what happens when you starting doing 50-100TB of recoveries a week, with a minimum of 2 week retention? Yes, you save some space with images of drives that are not full, but that only goes so far.

So, I guess I'm one of the guys who generally stays with drive-to-drive clones. I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process. As I might only have one kick at the can, I'm going to be ready for whatever comes my way. I also like the flexibility to be able to move the recovery to another system, if needed.

As for having to wipe drives, it isn't much of an issue. We can connect many drives to a single system and have the wipe through the night.

[labtech]

Drive-to-drive cloning here, too. Primarily due to flexibility to move the clone to other systems.

[pcimage]

Drive-to-drive here too

[northwind]

Drive to image files here

[Amarbir[CDR-Labs]]

Drive to drive here

[digisupport]

+1 for drive 2 drive

[lcoughey]

As I see it...all the smart guys and Amarbir go drive-to-drive...everyone else is just wrong. <---- this is meant to be funny, for those of you who take offense.

[mr_spokk]

Drive 2 Drive here as well

[S.Haran]

I cannot predict how full the drive is, nor can I predict the overall condition of the file system before I start the process.

Well I wrote a tool I call DataMap for this purpose. It is not perfect but I find it useful to quickly guesstimate how full of data a raw drive is by taking a small number of data samples. It is also good for finding the starting sector of lost partitions.

Here is an example of a 500GB HP notebook drive with 4 partitions. In this case I set DataMap to divide the drive into 48 blocks then sample 32 bytes from each block. The resulting map shows the drive is about 60% empty which fairly matches reality.

Code:

[======DISK======] [=============NAME==============] [====SIZE====]
[sda             ] [Hitachi HTS72755               ] [   465.76 GB]

[=====DEVICE=====] [==FILESYS==] [======LABEL======] [====SIZE====]
[sda1            ] [ntfs       ] [SYSTEM           ] [   300.00 MB]
[sda2            ] [ntfs       ] [<unknown>        ] [   443.66 GB]
[sda3            ] [ntfs       ] [HP_RECOVERY      ] [    16.80 GB]
[sda4            ] [vfat       ] [HP_TOOLS         ] [     5.00 GB]

[HDD Spaz]

Always drive to drive cloning. It takes a bit of time wiping the clones but it is by far the best method for recovery and it also free's up the PC3000 systems when needing to extract the data.

[H13]

Drive to image ...
why i need to image all the drive if its only few GB's off data !!!

[digisupport]

@H13 no need to image all drive, select only needed data and image drive 2 drive.
@HDD Spaz i always use DE to save data, you can run many DE processes in work with copy only. Not limited to number of PC3K ports. (dest. drive is of course not connected to PC3K port)
@lcoughey nothing wrong with image to file works great, i just like to keep things separated. Also keeps a destination drive for 30 days together with patient, if a case needs to be reopened.

[lcoughey]

For those who image to file, what kind of storage do you have connected to your PC 3000?

[Amarbir[CDR-Labs]]

For those who image to file, what kind of storage do you have connected to your PC 3000?

Hee Hee ,
Luke Now Thats Going To Be a Hard Drive " Most Possible In RAID Setup "

[data-medics]

I've got 8x 4Tb HGST SAS Enterprise drives in a RAID 6 (so 24Tb effective). Along with an Areca 1880i controller. It's enough to keep all the smaller images for at least two weeks. Bigger drives such as a full 4Tb I'll still image out to a single drive. I'm actually considering adding another external RAID to it for more storage, but haven't gotten to it yet.

I usually image by bitmap unless I can't get a full read of the MFT or expect to be looking for deleted data for some other reason, so that significantly cuts down the size of the image files. Expecially when it's a 4Tb that only has 200Gb actually used on it.