info at smallinnovations.nl <info@???> wrote:

> Your right, even with the ro flag the mounting pc would try to repair the filesystem. For more information and the solutions see http://forensicswiki.org/wiki/Forensic_Live_CD_issues.

Well that's a facepalm moment. Very interesting article.

A few other bits ...
Thanks for the comments on and off list.
Yes, I normally image the whole disk and then work with the image. There are three fundamental reasons for not doing it this way this time.
1) Size. The disk is 3TB and I don't have enough space for the image AND to copy the recovered files to.
2) It's a Seagate - with signs it does some of the usual things Seagate drives do when there are errors. Specifically, I've seen it with several drives where once you hit some error condition, all future access fail - so a tool like ddrescue then sees all blocks from that error point to the end of the disk as bad. It needs a lot of manual intervention to work around this and in the past I've always given up as "too hard, not worth the effort". Did I mention that I "dislike Seagate intensely" now and I've not seen this with other makes.
3) As it's a relatively small number of large files, if I do it file-by-file I can quickly see if a file is completely readable (I've got about 1/4 so far) and if a file looks like having bad blocks I can skip it (most can be re-recordable eventually when they get repeated). It's a lot easier to deal with the missing recordings if there's a smaller number of them.

It's been fairly easy to knock up some scripts to automate the bulk of the work - so I can set it off and just keep an eye on it while I do other stuff. The main thing is spotting when the drive goes into "f**k you I'm giving up" mode and stopping the script before too many log files get false errors - and then "fixing up" those that do before having another run when the drive's cooled down.

For good measure, I had two spare old PCs in the loft. Both worked fine last time they were used. Both are "not working" now :-(