2
It's a general principle in hard drive and data recovery that when recovering data from a hard drive, making write operations to the damaged disk should be avoided at all costs in order to prevent the lost data on the disk being overwritten. This is typically accomplished by running read-only data recovery software from a different drive to the one affected.
However, I'm wondering whether the simple act of connecting a secondary drive (i.e. a drive other than the one the OS is booting from) to an OS could allow the OS to make write operations to a drive. Do the Windows or Linux operating systems make automatic, background writes to hard drives they can see - and if so, how can these be avoided? If not, do operating systems generally only write to drives as and when the user expects them to?
@dsstorefile - Is this a yes? Does this mean that everytime I've gone to pains to recover a HDD using read-only recovery software, Windows and Linux themselves have been writing to the HDD? – Hashim – 2018-03-03T02:41:52.843
@dsstorefile Ah, I see. What's the logic in disabling automount and equivalents then? – Hashim – 2018-03-03T02:59:36.433
1Hmm that's a very good question, I wouldn't think that the OS writes to it on any high-level view (File System transfering things randomly) however I could see SMART writing logs to the disk or maybe some part of the flash which may also be damaged (easier to fix the controller part of an HDD that the mechanical portion however). – Tmanok – 2018-03-03T04:33:40.300
1
If you want to avoid write operations you should try Kali Linux, when starting from a USB it has a forensics mode wont use the disc, https://docs.kali.org/general-use/kali-linux-forensics-mode
– Chico3001 – 2018-03-03T07:49:52.427