DeepSpar imaging failure

[RMP_Cyber]

Hi,

I'm hoping that someone with more experience can help me out with this one.

We've got a Samsung (Seagate) ST500LM012 HDD which is detected by DeepSpar, however, every sector is being reported as unreadable after a considerable amount of time trying each sector (yellow colour), I'm sure that every sector surly is not bad, therefore, I'm considering that it could be the heads or firmware that are at fault.

We do have PC3000, however, until we can get on a training course, using this tool is trial and error, which is not ideal on an evidential item.

Does anyone have any suggestions to fault diagnosis using PC-3000 before resorting to a head swap.

Thanks in advance.

[lcoughey]

If you have a legit PC3K system, contact ACE tech support. http://ts.acelaboratory.com/

[RMP_Cyber]

Yes, fully legit, just limited to where we can obtain training from, Russia and China are not an option, we've been speaking with the makers of DeepSpar in Canada, however, there does not appear to be any public courses available and the bespoke courses are really expensive so we would probably struggle to obtain justification!

[labtech]

I'm considering that it could be the heads or firmware that are at fault.

Any preliminary information provided by customer regarding failure? Terminal output?
-------------------
About training:
Start reading the PC3K manuals. That should help with the fundamentals and take one in the right direction.

Important to understand is that a tool, no matter how great it is, it is unable to "tell" what the problem is. It is the human that has to interpret the drive's behavior correctly based on the tests conducted whether it is with DeepSpar, Atola, PC3K, terminal, etc. This only comes with reading/training, understanding, practice, test & trail, documentation, analysis, R&D, and so on. And once one combines those things then things develop and begin to come together = experience.

[RMP_Cyber]

Thanks guys,

No unusual sounds, or anything else that is odd.

We are actually a forensic department for a law enforcement agency, this was an exhibit that failed to image through FTK Imager, due to the sensitivity of some of the items that we deal with, we don't outsource a great deal of items.

We have a good team when it comes to straight forward digital forensics, but specialist roles such as HDD repair, chip off, etc. are still a massive learning curve, we'll get there, it will just take time. It does not help that we do not deal with HDD repair or mobile device chip off on a constant basis.

Thanks for the offer of remote assistance, but we can't do that, again due to the sensitive nature of some of the work that we deal with.

Thanks.

[labtech]

You may consider onsite recovery where someone comes to you. I doubt the cost will justify the service, but it is an option, especially if you can partner with somebody local who can do provide this service consistently.

[Cleanroom]

PM Sent

[labtech]

You may consider onsite recovery where someone comes to you. I doubt the cost will justify the service, but it is an option, especially if you can partner with somebody local who can do provide this service consistently.

The same concept would apply for training, where someone comes to you. Perhaps it would be more affordable (and perhaps more valuable) then Ace classes, as this can be customized based on your exact needs.

[lcoughey]

We just have officers come here for our assistance and we do our best to do all the work with them here.

[dick]

Hi! I just sent you a pm suggesting a company near you which might be able to help with this matter. Good luck!

[TXRanger]

Do you know what the scenario is behind the failure? Was the drive dropped? Or was it working fine and suddenly quit? If there is no reason to suspect platter damage or a crashed head, you can use the DeepSpar to try imaging specific heads. First build a heads map (Image -> Build Heads Map, or Ctrl+H). Then run the media test (Source -> Media Test or Ctrl+M). It should display results for each head and if there is one or more heads with green, you can image only the working heads by unchecking the weak / failing heads in the imaging screen (Imaging -> Imaging Process or Ctrl+I) at the bottom of the screen. If successful, then at least you have one or more heads worth of data imaged before you have to open the drive or do more invasive repairs.

[Cleanroom]

Do you know what the scenario is behind the failure? Was the drive dropped? Or was it working fine and suddenly quit? If there is no reason to suspect platter damage or a crashed head, you can use the DeepSpar to try imaging specific heads. First build a heads map (Image -> Build Heads Map, or Ctrl+H). Then run the media test (Source -> Media Test or Ctrl+M). It should display results for each head and if there is one or more heads with green, you can image only the working heads by unchecking the weak / failing heads in the imaging screen (Imaging -> Imaging Process or Ctrl+I) at the bottom of the screen. If successful, then at least you have one or more heads worth of data imaged before you have to open the drive or do more invasive repairs.

Cannot head map on a deepspar machine with samsungs, but you can on the pc-3000.

[einstein9]

Thanks guys,

No unusual sounds, or anything else that is odd.

We are actually a forensic department for a law enforcement agency, this was an exhibit that failed to image through FTK Imager, due to the sensitivity of some of the items that we deal with, we don't outsource a great deal of items.

We have a good team when it comes to straight forward digital forensics, but specialist roles such as HDD repair, chip off, etc. are still a massive learning curve, we'll get there, it will just take time. It does not help that we do not deal with HDD repair or mobile device chip off on a constant basis.

Thanks for the offer of remote assistance, but we can't do that, again due to the sensitive nature of some of the work that we deal with.

Thanks.

Well my dear, if you cannot offer remote help
and you don`t have much experience on such cases
and you have a problem

how do you plan to solve it? its just a Q here for you to think about

also consider, if you take and try any stupid advice from anywhere and you don`t know if its gonna kill your drive or not

so i think you have no other choice here ( in my opinion )

all the best ,,,