Contagious errors: Understanding and avoiding issues with imaging drives containing faulty sectors
2008 (English)In: Digital Investigation. The International Journal of Digital Forensics and Incident Response, ISSN 1742-2876, E-ISSN 1873-202X, Vol. 5, no 1, 29-33 p.Article in journal (Refereed) Published
When using certain tools to image drives that contain faulty sectors, the tool may fail to acquire a run of sectors even though only one of the sectors is really faulty. This phenomenon, which we have dubbed "contagious errors was reported by James Lyle and Mark Wozar in a recent paper presented at DFRWS 2007 [Lyle, J., Wozar, M. Issues with imaging drives containing faulty sectors. Digital Investigation 2007; 4S: S13-5.]. Their results agree with our own experience from testing disk imaging software as part of our work for the Swedish National Laboratory of Forensic Science. We have explored the issue further, in order to determine the cause of contagious errors and to find ways around the issue. In this paper we present our analysis of the cause of contagious errors as well as several ways practitioners can avoid the problem. In addition we present our insights into the problem of consistently faulty drives in forensic tool testing.
Place, publisher, year, edition, pages
2008. Vol. 5, no 1, 29-33 p.
Acquisition of digital data, Hard drive imaging, Testing forensic tools, Faulty sectors, IDE/ATA Linux, DCFLdd, dd, sdd, ddrescue, dd_rescue
Engineering and Technology
IdentifiersURN: urn:nbn:se:liu:diva-16120DOI: 10.1016/j.diin.2008.03.002OAI: oai:DiVA.org:liu-16120DiVA: diva2:133200