Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20109

General Discussion: Hard Drive Issues -- a different approach

$
0
0
jaclaz wrote: NOT what you actually asked for (exactly) but you can use *any* tool you normally use to wipe (00) the whole disk, calculate it's hash once 00ed and compare it with the theoretical hash of a 00ed disk with exactly the same number of sectors through a tool like: ... If I read that kind of disk through an USB bridge with an LBA translation deficiency (say, LBA-40 with wrap-around, as that's where 2TB is), I may read the right number of sectors, with the right contents, without knowing that I don't actually read the right sectors (this point also seems to be made in some of the links you provided). I think that the lowest requirement is that a sequence of unique and predictable sectors should be written to the drive, followed by a read of all sectors, verifying that they indeed do return the same sequence. And while a hash will verify that, it's diagnostic utility is too small in case of a problem -- sector-by-sector read-and-verify seems somewhat better, as it can report the exact LBAs where problems are detected. The closest thing I have found so far is the diskwipe tool in the NIST FS-TST toolkit. Unfortunately it is designed to run on DOS only.

Viewing all articles
Browse latest Browse all 20109

Trending Articles