Forensic SF-5000 FAQs

Bad (or "weak") sectors on the suspect drive are handled in the following way:

By default the first option is set to "Abort", the Forensic SF-5000™ will abort the capture process upon encountering the first bad sector. Note that the Forensic SF-5000™ will still make several attempts to correctly read the sector in question, but unless a perfect read was achieved, the process will abort.

The second option is "Skip". When this option has been selected, the Forensic SF-5000™ will still make several attempts to achieve a perfect read, but will move past the bad or weak sector instead of aborting. Note that there may be a CRC-32 mismatch after the capture session has completed.

The third option is "Retry". This option instructs the Forensic SF-5000™ to spend more time attempting to read all of the data from the bad or weak sector. This option can slow down the capture process.

The forth option is "Recover". When selected, the Forensic SF-5000™ will use a more complex algorithm in an attempt to retrieve as much data as possible from each bad or weak sector. Although this option is very effective at recovering data from bad or weak sectors, it can be time consuming.

Bad sectors on the target drive are handled as follows:

If the Verify setting is disabled, the Forensic SF-5000™ will not detect bad sectors on the target drive, unless the drive returns an error. Note, however, that newer drives use automatic reallocation and will rarely exhibit a bad sector, and thus reduce the probability of a problem to a negligible amount.

With the Verify setting set, the Forensic SF-5000™ will perform a scan operation on each sector after data has been copied. This scan occurs in step with the capture session and is transparent to the user. If an error is detected, the Forensic SF-5000™ will make several retries and abort if unsuccessful.

The Wipe clean Target mode writes zeros to every sector on the target drive. This is single pass operation. Both the pattern (0x00) and the number of passes (1) are fixed and cannot be modified by the user.

There are two methods of wiping:

There are many factors that determine transfer speed:

The age of the drives - The speed of the operation is governed by the slowest drive in the system. If an old drive is used, chances are it cannot sustain high transfer speed. Newer drives have faster electronics and larger caches, and can sustain rates as high as 16MB/sec.

Suspect drive with bad or weak sectors - With the Sector Recovery option enabled, the system will attempt to recover data from bad or weak sectors found on the suspect drive. This can be a time consuming operation, and may cause the overall speed of the capture to drop.

Suspect drive with bad or weak sectors - With the Sector Recovery option disabled, the standard retry mechanisms may still result in a reduction in transfer speed.

The printed report is a single page report that includes the manufacturer, model number, and serial number and drive geometries of both the source and destination drives. The report also gives any options used and user settings. The CRC-32 from the Source drive and the CRC-32 from the destination drive after the capture process is completed is also recorded. The report also allows for the user to record the case number, location, time and date of capture and the name of the officer doing the capture.