How do you deal forensics with physically damaged harddisk

How do you show up chain of custody for a physically damaged disk that gives different md5sum every time you compute.

mahesh@jacksparrow:~#script (saves all the commands and output to file typescript)

mahesh@jacksparrow:~#dd if=/dev/dev2 bs=512 | md5sum (1st time)
mahesh@jacksparrow:~#dd if=/dev/dev2 bs=512 | md5sum (2nd time)
mahesh@jacksparrow:~#dd if=/dev/dev2 bs=512 | md5sum (3rd time)

Each instance will report different hash proving that you haven’t tampered the disk and it was little damaged.

So How do you identify damaged disk? 😉
some clues – Is it making trance kinda music while reading? Is it not fit when you take it in hand?

Advertisements

About wikihead

A security freak
This entry was posted in Uncategorized and tagged , , . Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s