Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20114

General Discussion: Forensic Imaging of USB Drive with Corrupt File System

$
0
0
If I may, let's try NOT mixing things all together. (physical vs. logical). If the flash drive is fully functional you do a dd-like or "forensic sound" PHYSICAL image (that is completely "agnostic" to the filesystem(s) used and to whether the filesystem(s) is/are valid or corrupted). Then you make a copy (still "physical") of the image and either carve it for the files or attempt rewriting/fixing/repairing the filesystem structures. Be warned that a chkdsk (even without "f" option) SHOULD (if it is the case) NEVER be run on the actual flash device directly if NOT through a writeblocker (only to underline the need of what athulin posted). BUT, *any* disk imaging tool will work fine with a fully functional device, so, as already said before, it is very likely that you have a much "deeper" problem, including unreadable (faulty) areas of the device. Your best option, if this latter is the case, is actually ddrescue (or a similar "recovery oriented" tool) that will automate (given the correct options) the skipping of the sectors and also further attmpts to read. jaclaz

Viewing all articles
Browse latest Browse all 20114

Trending Articles