Mikerochip Technical Solutions
/b/  
social
  • Mikerochip
  • Services
  • Rates
  • Polls
  • Testimonials
  • Products
  • Blog
  • About Us
  • Contact Us

Crash recovery by use of forensic tools

23/4/2015

0 Comments

 
ddrescue
Upon the clients laptop smashing to the floor and the LCD becoming a colourful mess, I extracted the hard drive so that it could be copied.  A cyclic redundancy check error was preventing the drive from being read.  CRC's are an error-detecting code that is used in storage devices and digital networks to detect accidental changes to raw data.  Blocks of data get a short check value attached, based on the remainder of a polynomial division of their contents.  {from: wiki }

First you copy as much data as possible, without retrying or splitting sectors:
  • ddrescue --no-split /dev/hda1 imagefile logfile 

Now let it retry previous errors 3 times, using uncached reads:
  • ddrescue --direct --max-retries=3 /dev/hda1 imagefile logfile 

If that fails you, try again but this time retrimmed, so it tries to reread full sectors:
  • ddrescue --direct --retrim --max-retries=3 /dev/hda1 imagefile logfile 


{from: www.forensicswiki.org }

The failure went from 57.1KB to 1024b.  Sir, you may have your drive back, and your family photos have been saved!

0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Did I help?

    consider a donation!
    ​paypal.me/Mikerochip

    Mikerochip:

    Spewing my mind about tech


    Archives

    March 2018
    December 2016
    June 2016
    September 2015
    May 2015
    April 2015
    March 2015
    January 2015

    Categories

    All

    RSS Feed

Don't buy new, speed up your current computer for less!  Ask us how...


Local, fast, friendly service in the Gatineau Hills, the Nation's Capital and beyond!

​

Telephone

613-850-1334

Email

info@mikerochip.ca