Anything related to computer forensics (new section!)
March 28th, 2013, 4:28
Hello all.
I was hoping if someone can tell me whether the HDDRawCopy software can copy an entire hard drive byte by byte starting with sector 0 and ending with sector N of any given hard drive ? I not only want the actual contents copied to the destination drive but want to recover some removed or deleted data from the source drive.
Also can anyone tell what is the difference between the software that forensic experts use and the free software offered by HDDGuru ?
Thanks
Victor
March 28th, 2013, 12:18
As long as you're working with a cloned copy there is no harm in trying data recovery software. It probably wont do you any good though, unless your looking for something deleted very recently. Also it should be common sense but I'll mention it anyways, whatever software you're using make sure you're installing it on a different drive from the one that you're going to be scanning.
March 28th, 2013, 12:55
Thanks Spildit.
Can you tell me something about some other data recovery software like GetDataBack or Erunt or testdisk-6.11.3 how do these compare with the two you have mentioned in your reply ?
Also I would like to ask if anyone can tell me about the layout of a hard drive. Is it possible that a given IDE HDD stores track of more then one FAT ?
Thanking you
Victor
March 28th, 2013, 13:05
Spildit wrote:That tool will work fine as long as the drive doesn't have bad sectors and it's not damaged.
Be sure to clone the drive with the data you want to recover to a clean one, and not the other way arround.
Trying to recover important data by yourself is not adviced, you may want to take the drive to a pro and ask assistence if you are not sure about what you are doing.
When the cloning is done you will have to use something like Restorer Ultimate or R-Studio to try to recover the data from the clone.
You will have to then copy that data to another drive.
Best regards and wishing you luck for your recovery.
Thank you for the reply. Are the two products above you have recommended better then the others such as GetDataBack or Erunt or Easeus ?
Thanking you
March 29th, 2013, 19:07
Spildit wrote:Victor43 wrote:Spildit wrote:That tool will work fine as long as the drive doesn't have bad sectors and it's not damaged.
Be sure to clone the drive with the data you want to recover to a clean one, and not the other way arround.
Trying to recover important data by yourself is not adviced, you may want to take the drive to a pro and ask assistence if you are not sure about what you are doing.
When the cloning is done you will have to use something like Restorer Ultimate or R-Studio to try to recover the data from the clone.
You will have to then copy that data to another drive.
Best regards and wishing you luck for your recovery.
Thank you for the reply. Are the two products above you have recommended better then the others such as GetDataBack or Erunt or Easeus ?
Thanking you
Erunt is a tool to backup the registry and to restore from those copies. Unless you are talking about another Erunt that i don't know, this one will not help you out recovering data.
GetDataBack is fine, as long as you select the correct one (Fat or NTFS acording to what files system you are trying to recover data from). I don't know Easeus.
@Spildit: Thanks for the reply. I'm incorrect about Erunt. You are right it is a backup/restore registry program.
@sashok07 Thanks for the reply and the tips. Yes indeed I do know that when data recovery is needed it is important that the drive containing the data being recovered should not be the bootable drive.
May 26th, 2013, 11:32
When you are considering making an image for any Forensic Related work. Consider Write Blockers before proceeding further with Software related tools like "HDDRawCopy"
"DD Rescue"
One Tool that has automatic write blocking to disk & which works in DOS is
"Media Tools Pro" which can try number of times for bad blocks & do reverse imaging.
May 27th, 2013, 7:36
Mediatools is the best cloning software you can find, second place DMDE (this is my opinion).
Keep in mind that in some cases even Media Tools isn't able to clone bad sectors, not even trying to read on these sectors for thousands of times.
In this case you need professional hardware+software tools as pc3k Data Extractor or DDI.
May 27th, 2013, 8:41
""Media Tools Pro" which can try number of times for bad blocks & do reverse imaging." ddrescue does it also
March 19th, 2014, 1:45
U can try now HD clone for cloning your hard disk I use this software
Powered by phpBB © phpBB Group.