Hello all,

I need to take a copy or better yet a "cloning" of a HDD to search for evidence and other things.

Offcourse this needs to be done without touching the timestamps on the original HDD, I'll put the clone back in the machine and take the original along.

Afterwards I'll put it in another machine and copy it again to work of that copy and leave the original alone...

Then I'll hang that copy as a slave and investigate it.

The Computer has Win98 as OS.

Now ...my questions:

1- Does anyone know any good Disk cloning tools or would Symantec Ghost be ok ?

2- What tools do I use for searching the disk for evidence ...It's not hacked ...it's just to see the surfing and chatting habbits of someone. (it's not illegal the pc is not this persons property but from the person that gave me this "job" and is owner of this PC) and confront him/her with it.

3- Does the way I plan to do this look ok to you forensic experts or would you choose another path/way to do things.

Many thanks for any help,

If I need to give more info let me know.