Imaging damaged disks

Many hard drives fail in a way that just some sectors can not be read. This will often render the drive impossible to read as a standard drive and so make data recovery essential.

Sometimes it is possible to use the standard CnW recovery tools, for NTFS, Mac etc. If the disk has many bad sectors, the standard process can be execeptionally slow, and difficult to restart after a failure. The best option in these cases is to construct a disk image file which can the be used with the standard CnW tools.

The disk image file is created used the Image Raw function and all options are then disabled, ie no file splitting (though for Raid 0 disks, the Raid 0 options must be set). The resulting file is same as would be produced using the Unix / Linux DD command. The added improvement is that aresa can be skipped and imaging can be started part through the disk, but the resulting file will be padded to emulate a complete DD image.

The first procedure to start with is to try and image the complete drive - obviously onto a new drive with a higher capacity. Reading should be seen to be reasonably fast, but typically disks with bad areas will stop, or go exceptionally slowly over bad areas. At these points if is often advantageous to skip over the bad areas and this is very possible using CnW Recovery software. The image file may be constructed in several stages, and not necessarily is sequence. It is possible to image the first 1GB and then the final 1GB. In this case, the middle GBs will be padded, and can be imaged later.

Automatic skipping of bad areas

When the disk hits a large bad patch, there are options in the Configure, Hardware Config menu to allow automatic skipping of bad areas. For instance, one can set the program so that when it detected 10 bad sectors in a row, it will then skip the next 100. Forensically, this will leave a dubious image, but in practice, it does allow a usable image to be created in a sensible period of time. If the automatic skipping has jumped over important sectors, an attempt can be made to image these later.

Recovering specific areas of the disk

This stage of recovery gets interesting, and can be very satisfying. Having made a partial recovery of the disk we try and track down where required files are stored, so that the correct area of the disk can be imaged. The procedure for this is to attempt a full recovery of the created image file using NTFS, FAT32 or MAC as relevant for the disk. Obviously, there needs to be enough data on the image file to read the main MFT, catalog file or directory. Using the log will then be possible to see required files are stored. These areas can the be concentrated on to select areas of disk imaging. If only a few files are required from a disk, maybe then only 10% will need imaging saving time.

Order of imaging

A very valuable feature of CnW Recovery imaging is that it can be done in stages, in any order. The program will create a flat file for the disk image, and will fill in sections as requested. This means that the final 10GB can be imaged first, and in this case, the first section of the disk will be padded with ‘blank’data. This blank data may then be overwritten at any stage.