Difference between revisions of "Recovering bad data"

From ForensicsWiki
Jump to: navigation, search
m
m (Reverted edit of Porker, changed back to last version by Uwe Hermann)
 
(One intermediate revision by one other user not shown)
(No difference)

Latest revision as of 11:57, 16 April 2006

A forensic investigator uses techniques that can recover bad data in order to recover data from a disk drive that is malfunctioning.

One popular program for recovering bad data is SpinRite. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each bad sector, with the hope that a good read may eventually happen.

The dd_rescue program can't recover from bad sectors, but it can skip around a disk and recover data that is still mostly good. dd_rescue reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The aimage advanced disk imager implements a similar algorithm.