Difference between revisions of "Recovering bad data"

From Forensics Wiki
Jump to: navigation, search
m (Reverted edit of Porker, changed back to last version by Uwe Hermann)
 
Line 1: Line 1:
Man shot dead at vehicle checkpoint
+
A [[forensic investigator]] uses techniques that can '''recover bad data''' in order to recover data from a [[disk drive]] that is malfunctioning.
A man has been shot dead by police at a vehicle checkpoint in Northern Ireland. Officers fired a number of rounds during the incident on Church Street in Ballynahinch, County Down. The man shot dead was the  in Ballynahinch, County Down. The man shot dead was the
+
 
 +
One popular program for recovering bad data is [[SpinRite]]. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each ''bad'' sector, with the hope that a good read may eventually happen.
 +
 
 +
The [[dd_rescue]] program can't recover from ''bad'' sectors, but it can skip around a disk and recover data that is still mostly good. [[dd_rescue]] reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The [[aimage]] advanced disk imager implements a similar algorithm.

Latest revision as of 11:57, 16 April 2006

A forensic investigator uses techniques that can recover bad data in order to recover data from a disk drive that is malfunctioning.

One popular program for recovering bad data is SpinRite. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each bad sector, with the hope that a good read may eventually happen.

The dd_rescue program can't recover from bad sectors, but it can skip around a disk and recover data that is still mostly good. dd_rescue reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The aimage advanced disk imager implements a similar algorithm.