Printable View
Greetings'..
I need software to copy a disk for forensic examination. I will be carrying an USB 2.0 external Hard-disk and Ill need to copy either the entire disk or certain parts of it but for forensic examination.. Hence I'll need some kind of software that will preserve the dates of the file.
Please help on ASAP basis since my investigation is already on... I would also like it if there is a software which lets me do this over the network...
THANKS A LOT IN ADVANCE...
You might try FCCU. It's a live cd and widely used in Europe for forensics.
I've seen a paper or two on using Ghost for creating an "as-is" image for
forensics. Forensics is a complicated subject, and others here will know
better than I what will work. Encase seems to be the standard for computer
forensics in the U.S.
FCCU link: http://www.lnx4n6.be/
I THINK if it is from an NTFS filesystem all the timestamps will remain. Other things - the only way to do it would be a complete ghost.
Boot from a linux live CD and use the dd command to create the diskimage. Something like dd if=/dev/hda of=myimage bs=512.
^^ what dice said.
Well, the advice is nice. Well, how would one open up the image created by the 'dd' command? What software can be used for the purpose?Quote:
Originally Posted by SirDice
On linux you can use i.e. mount -o loop -t ntfs myimage /mnt/
and if the forensics is for any kind of criminal activity
keep full documentation too
use only licensed software
and have a witness at all times
if it is just for educational purposes
scratch th eabove :p
Check out this link:
http://www.lnx4n6.be/index.php?sec=D...&page=netcatdd
Alter your source drive from HDD to DVD.
Hi Byte~ here are a couple of tutorials that might help:
http://antionline.com/showthread.php?t=264701
http://antionline.com/showthread.php?t=253552
Cheers,
:)