Acquiring evidence files using disk cloning techniqiues
HI
i was reading your post on disk cloning... I would just like to point a few things out as this is what i have to do day in day out..
1 where possible removed the suspect disk and use such a device as a write blocker (fastbloc, or tableau device) this blocks the writes to the hard disk when it is fired up.. then use some software such as encase of FTK to create image files this will allow you to demonstrate that you have indeed maintained data continuity . when these image files are created they create and md5 hash which can be used to verify that the data has not been altered.