Monthly Archives: January 2010

Voom/Hard Copy II (2) and Hard Copy III (3) – Field Use Advisory

I have generally been a fan of Voom’s products for making computer forensic copies. We use them regularly in the office. I purchased a HC II when they first came out. I have used it successfully in the field and the lab and was always impressed by its speed.

This changed during an on-site acquisition a couple of years ago. I was imaging a tiny 10GB drive. About 3/4 of the way through, it hit some number of bad sectors. The HC II went into “Error Recovery” mode for about 10 minutes and it showed no sign of making progress. We waited over 30 minutes in total and still no progress appeared to being made.

We had to stop the process and we relaunched the acquisition with a laptop-based, write-protect device.

I had queried Tech Support about having an expedited error mode for their product, but it was not something high on their priority list, given the soon to be released HC 3.

Reading great things about the HC 3 and understanding that it had a better (i.e.faster) error recovery process, we decided to pick one up.

This device has been great up until today. During a single drive acquisition, an 80GB Hitachi 2.5” sata drive built in Nov. 2007,the HC 3 went into Error Correction la-la land, just like its predecessor, theHC II. Although it had started out at a speedy 3.5GB/ min, this all changed when it apparently hit some bad sectors in the11GB range.

The 20 or so minutes I waited for it to get beyond this bad patch was unacceptable, especially with the user waiting for their laptop to be returned to them.

So, I had to stop the process and I connected the drive to a laptop using a WiebeTech sata write-block (which I highly recommend) using FTK imager.

FTKimager’s error handling is the way the HC should be setup. It sped through the rough patches that ground the HC 3 to a essential halt.

I will not buy another HC3 and would not recommend it for field use until the folks at Voom include an error correction process that is the equivalent of that on the Logicube, FTK imager, and the dd/dcfldd “conv=noerror,sync” methods. It is unacceptable today to be left waiting for what should be a very expeditious process due to some über-rigorous error correction.

I appreciate that the Voom folks have different types of clients to support. No doubt certain segments will want every last bit taken from a drive, regardless of the time it takes to do so. However, there is another segment who needs to get in and out from a client location in as little time as possible. If you add to this imaging in a “hostile” environment, this makes it even more imperative to not get bogged down, possibly to a very significant extent while your imaging efforts spin off into the ether as the HCs attempt to perform their error correction.

Until Voom addresses this issue, I do not believe they have a product that can be used with confidence to complete an acquisition in a timely manner.