-
May 18th, 2006, 02:11 PM
#1
Surface scanning tool...
Hey, does anyone know of a tool that can be used to perform a surface scan on a hard disk with no partitions/filesystems. Obviously, the tool cannot be destructive nor can it attempt to move the data elsewhere, as I need it for data recovery and cannot risk it overwriting valid data.
Cheers,
cgkanchi
-
May 18th, 2006, 02:26 PM
#2
I would think that dd could be used to dump the disk to an image and then you can use autopsy to browse through, reconstruct the MBR/FAT (or whatever is used to hold the file structure). I can also allow you to manually browse through different portions of the disk and to look at slack space if needed (though its manual and slow). They are all free but you need linux. Regardless, since you are playing with an image at that point, no risk to the disk.
There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.
(Merovingian - Matrix Reloaded)
-
May 18th, 2006, 03:32 PM
#3
Needing linux isn't a problem. I already have it . Anyway, I could always use a live cd and install programs to /tmp and/or the ramdisk. This approach struck me, but I don't know what the state of the disk is (I'll be getting another disk to dd it over to on Saturday). Also, something that surface scans a disk without a filesystem would be a useful tool to have in case you have a totally fscked disk.
Cheers,
cgkanchi
-
May 18th, 2006, 03:37 PM
#4
Try Spinrite. It's a bootable CD. You'll have a couple of recovery options.
http://www.grc.com/sr/spinrite.htm
“Everybody is ignorant, only on different subjects.” — Will Rogers
-
May 18th, 2006, 03:50 PM
#5
Originally posted here by cgkanchi
Needing linux isn't a problem. I already have it . Anyway, I could always use a live cd and install programs to /tmp and/or the ramdisk. This approach struck me, but I don't know what the state of the disk is (I'll be getting another disk to dd it over to on Saturday). Also, something that surface scans a disk without a filesystem would be a useful tool to have in case you have a totally fscked disk.
Cheers,
cgkanchi
IIRC, dd does not require a file system...I don't remember if Autopsy requires you to select a file system type or not; however, I would assume it would need it b/c at some point it would need to know how to break out the disk (ie, how many sectors to a cluster)...
As far as bootable CDs, I am pretty sure Helix has all of this on there: http://www.e-fense.com/helix/
There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.
(Merovingian - Matrix Reloaded)
-
May 18th, 2006, 06:41 PM
#6
IIRC, dd does not require a file system
No, it doesn't.
Cheers,
cgkanchi
-
May 19th, 2006, 02:14 PM
#7
Hi cgkanchi
My first move would be to look at the tools on the HDD suppliers website. They generally have some pretty low level diagnostic capabilities?
-
May 23rd, 2006, 03:00 AM
#8
Jesus Christ! I ran spinrite at level 2 (surface scan and recover data) and the damn thing read 34 odd megs in >12 hrs. Is this anywhere close to normal for spinrite? Because if it is, there really was no point in my buying it :-S. This is a 200GB disk we're talking about here! There's no way on earth I'm taking a month to recover this data, even with the obscene payoff!
Cheers
-
May 23rd, 2006, 03:15 AM
#9
Something's not right. Last time I used Spinrite it went thru a Level 2 recovery on a 40 gb hdd in about 24 hours.
“Everybody is ignorant, only on different subjects.” — Will Rogers
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|