Most Important thing while doing DATA Recovery / Forensic is souce hard disk should not be modified . If souce hard disk is connected to windows based machine chances are that windows may write by following means-

1) scandisk / Chkdsk
2) System restore / Recycle Bin folders are created
3) Swap file creation.
4) Conversion on file system like NTFS v 4 is automatically converted to NTFS 5

Does anyone know write blocker hardware to protect source hard disk? .Can someone suggest any modification in windows
registry to stop scandisk ? I would like to know review of Salvationdata Data Recovery Mate Hardware which is cheapest option US$190 + US$50 .
Thanks and Regards
Hddbug

Use MED or copyr, or any dos utility which has capability to clone the hard disk.

DF

_________________
DF
www.datatracksystem.net

Hi
Thanks DF . Yes Souce drive can be cloned to keep its digital integrity intact. But considering the voluminious size of todays drives at times it becomes difficult to clone drive using DOS pio mode. In case where time is important if we use write blocker like http://www.mykeytech.com/nowrite.html will be handy.
I am planning to purchase salvationdata Data Recovery mate , kindly suggest me any alternate or product review of this product.
Thanks and Regards
Hddbug

Hi,
You can use Mediatools Pro for faster cloning.
Or disable autochk by modifying your registry: http://www.pctools.com/guides/registry/detail/907/

Best Regards

Bosse

_________________
Rescue IT Datarecovery service Sweden
Rescue IT Dataräddning Göteborg AB
http://www.rescue-it.se

I use these:
http://www.tableau.com/index.php?pageid ... ic_bridges

They are great and i usually use a program like X-ways forensics to clone and it gives you a log at the end so you know how many sectors could not be copied.

Hi
Thanks Bosse for nice suggestion . mediatools pro is the best cloning solution even for partially damaged drives
Thanks and Regards
Hddbug

Hi Zed

Yes these solutions saves lot of time as we can use windows based cloning tools.
Thanks and Regards
Hddbug

Dear hddbug,

You are total right. If souce hard disk is connected to windows based machine chances are that windows may write.

It is very important to ensure the data integrality of the source drive. However, during your data recovery and forensic image acquisition and analysis process, there're many possible write attempts towards the source drive, some by operation system or software you use, some by your careless operations. The result will then be data comfusion or data loss.

Our Data Recovery Mate assures write protect to your source disk during your data recovery work. By using the Data Recovery Mate, data can be read from the source drive without being inadvertently modified during the data recovery process.

Data Recovery Mate also assures write protect to your source disk during your forensic image acquisition and analysis process. By using the Data Recovery Mate, your source disk will be completely protected from being written anything.

Data Recovery Mate supports most of the HD in the market, ATA or SATA, 1.8-inch, 2.5-inch or 3.5-inch, etc.

If you want more details, please go to http://www.salvationdata.com/productDetail.asp?pn=00014
or contact me at MSN: sales.laura@salvationdata.com

Best Regards

Laura Lee

_________________
SalvationDATA--Profesionnal Hard drive solution Provider. MSN: sales.laura@salvationdata.com

Hi
Laura Thanks a lot for your reply. I am interested in Salvationdata products and can sell Data Recovery Mate here in India.
I would like to join Salvationdata Data Recovery mate test program which will help me evaluate Its features.
Once i become confident about the product i can promote it. Please let me know earilest when Data Recovery Mate Test program Asia will start again.
" Wish You and Team all the best"

Best Regards
Hddbug

Dear Hddbug,

Thank you so much!

Please send one email to my email address, then I will send one application form to you.

I hope we can cooperate with each in the near future.

Best Regards

Laura

_________________
SalvationDATA--Profesionnal Hard drive solution Provider. MSN: sales.laura@salvationdata.com

Hi Friends
In my quest to further make my DR business professional i was looking for solutions to protect Source Disk from Accidental write operations.
One of the industry standard rule is to make Bitstream Image ( Sector By sector cloning with slack space). But as drive size is increasing day by day its time consuming to clone 500 GB Hard disk using dos based tools.
Salvationdata is emerging as a Alternate for firmware level data recovery vendor. salvationdata Data Recovery mate (http://www.salvationdata.com/productDetail.asp?pn=00014) Seems to be ideal choice for Hard disk write blocker. I requested Laura ( sales.laura@salvationdata.com ) and she was quick to respond for a test unit. I appreciate for the quick support from her.
I am going to test it extensively on both IDE/ SATA drives and will report results which will be useful for all members.
Thanks laura
Best Regards
Hddbug

HddBug,

If you use a Linux CD also. They only mount when you tell them to.

A

Hi acforensics,
Thanks , yes Mounting Suspected drive in Linux (read only mode) is best and cheap solution. I have got salvationdata Datarecovery mate ( thanks to laura) , i am testing it and will put a review of it.
Thanks and Regards
Hddbug

Thank you for test report from hddbug.

_________________
SalvationDATA--Profesionnal Hard drive solution Provider. MSN: sales.laura@salvationdata.com

If you have PC3000 UDMA you don't need any product listed above.

_________________
DE AD

We use ICS drivelock for $195
http://www.ics-iq.com/index.cfm/action/ ... 9e011a7b38
It indicates the first write attempt, than the LED is still ON. It would be better to see each write attempt as on http://www.logicubeforensics.com/produc ... rotect.asp but the cost is much higher.

Thanks a lot kibul.

oh,I see

_________________
SalvationDATA--Profesionnal Hard drive solution Provider. MSN: sales.laura@salvationdata.com

we allso use this ICS drivelock for $195

top of the range forensic blocker