jaclaz wrote:
bombone wrote:
oh thanks. Now Ftk imager on all disk. E01 or dd?
bye thanksdd (and not E01) but why exactly FTK imager? <img src="images/smiles/icon_question.gif" alt="Question" title="Question" />
I mean, here you are dealing with data recovery, and not data forensics.
E01 makes no sense, the "dd" or "RAW" format is the "most compatible with any software" that you can have or that you will need, as it is a 1:1 as plain as possible copy.
Tools like ddrescue (or dd_rescue):
http://www.garloff.de/kurt/linux/ddrescue/
or equivalent for windows, example:
http://www.datarescue.com/photorescue/v3/drdd.htm
i.e. tools designed for data recovery, are way more suitable to data recovery than "forensic" disk imagers because they have normally provisions for "weak" or "slow" sectors.
A tool may manage such issues differently from other ones, like making a "chunk copy" and skip an area or replace the unreadable sectors with blank ones, but in any case they are advised.
Such data recovery imaging tools have the capability of attempting reading areas "backwards" which often gives good results.
Specifically, you already tried FTK imager on one disk and it stalled, reaching 32% after 24 hours, don't you think that trying *something else* is the case?
jaclaz
ok, many thanks i will try the softtware. you are preciuos
bye
↧