Eamonn,
First of all, you questions are far from being considered dumb. I am,
at the moment, encountering the same issues with 5 hard drives that I had
wipe to remove the sensitive data previously stored on them. Once the disk
drives were ready for reuse, I was unable to use them because, as you
stated, the BIOS did not recognize them. I have manually changed the BIOS
settings but with no success.
So I am very interested as to what the reasons are for the drives to not be
detected.
Tamarcus A. Person, GISS/DEF
CSC
IT Security Engineer
MTC Office: (301) 731-3520
MTC Fax: (301) 731-3257
MTC Cubicle: 12D22
tperson@csc.com
----------------------------------------------------------------------------------------
This is a PRIVATE message. If you are not the intended recipient, please
delete without copying and kindly advise us by e-mail of the mistake in
delivery. NOTE: Regardless of content, this e-mail shall not operate to
bind CSC to any order or other contract unless pursuant to explicit written
agreement or government initiative expressly permitting the use of e-mail
for such purpose.
----------------------------------------------------------------------------------------
Eamonn Saunders
<eamonn.saunders To:
forensics@securityfocus.com
@gmail.com> cc:
Subject: undetected drive
06/16/2005 10:25
PM
Hi,
First off allow me to ask for forgiveness in advance if the following
questions are dumb...I'm new to this area and I'm stuck.
I've been given a Maxtor 60G hard drive to practice/develop my forensics
skills. This drive has previously been analyzed by professionals. I've
imaged other drives before using dd and I typically use the tools on the
Helix incident response CD to do my analysis.
The problem I'm having is that this particular drive is not recognized
by the BIOS on my machine. By that I mean that the BIOS is unable to
figure out the geometry of the drive. I'm pretty confident that it's not
an issue whereby the BIOS can't deal with the size since:
a. I already have a much larger drive (200G) on the machine,
b. I downloaded the PowerMax tool from Maxtor, created a boot floppy and
it can't find the drive either. I had the jumper settings on CS and I
tried Primary master and slave connections. I know its not the cable
since I can plug other drives into it without a problem.
c. I tried the drive in another machine with an IBM BIOS and it doesn't
find it either.
So...my questions are...
1. Are there techniques that I am not aware of whereby a disk can be
made "non detectable"?
2. Does anybody have any other suggestions as to how I might access the
data on this disk?
Thanks in advance.
Eamonn
