Difference between revisions of "Recovering bad data"

From ForensicsWiki
Jump to: navigation, search
m
m (Reverted edit of Porker, changed back to last version by Uwe Hermann)
 
(2 intermediate revisions by 2 users not shown)
Line 1: Line 1:
Frequently we wish to recover data from a [[disk drive]] that is malfunctioning. In these cases it is necessary to use techniques that can '''recover bad data'''.
+
A [[forensic investigator]] uses techniques that can '''recover bad data''' in order to recover data from a [[disk drive]] that is malfunctioning.
  
 
One popular program for recovering bad data is [[SpinRite]]. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each ''bad'' sector, with the hope that a good read may eventually happen.
 
One popular program for recovering bad data is [[SpinRite]]. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each ''bad'' sector, with the hope that a good read may eventually happen.
  
 
The [[dd_rescue]] program can't recover from ''bad'' sectors, but it can skip around a disk and recover data that is still mostly good. [[dd_rescue]] reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The [[aimage]] advanced disk imager implements a similar algorithm.
 
The [[dd_rescue]] program can't recover from ''bad'' sectors, but it can skip around a disk and recover data that is still mostly good. [[dd_rescue]] reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The [[aimage]] advanced disk imager implements a similar algorithm.

Latest revision as of 11:57, 16 April 2006

A forensic investigator uses techniques that can recover bad data in order to recover data from a disk drive that is malfunctioning.

One popular program for recovering bad data is SpinRite. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each bad sector, with the hope that a good read may eventually happen.

The dd_rescue program can't recover from bad sectors, but it can skip around a disk and recover data that is still mostly good. dd_rescue reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The aimage advanced disk imager implements a similar algorithm.