Recovering bad data

From ForensicsWiki
Revision as of 16:57, 16 April 2006 by Uwe Hermann (Talk | contribs) (Reverted edit of Porker, changed back to last version by Uwe Hermann)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

A forensic investigator uses techniques that can recover bad data in order to recover data from a disk drive that is malfunctioning.

One popular program for recovering bad data is SpinRite. This program works by turning off the disk drive's own data recovery technology and repeatedly re-reading each bad sector, with the hope that a good read may eventually happen.

The dd_rescue program can't recover from bad sectors, but it can skip around a disk and recover data that is still mostly good. dd_rescue reads the disk forwards until it finds an error; it then goes to the end of the disk and reads backwards. The aimage advanced disk imager implements a similar algorithm.