Forensic Cloner needed

  • Thread starter Thread starter OZZY Boy
  • Start date Start date
O

OZZY Boy

One that supports SATA drives


Yes not just a backup or image program, one that can recover as much data possible and clone it to
a SATA drive.

Thanks
 
One that supports SATA drives

Yes not just a backup or image program, one that can recover
as much data possible and clone it to
a SATA drive.
Click to expand...

What do you mean? An image software is good enough for that.
A hardware write-blocker may be used in addition, you can get
them in various places. However, if you use, e.g. dd_rescue
from Knoppix, it does a read-only mount and writes nothing
to the disks.

Do you want a hardware cloner? If you do, take care that
you typically still need to record image size and
hash by using a computer.

Anyways, a simple google search for example gives you this
outfit:

http://www.forensicpc.com/products.asp?cat=13&partner=google

Arno
 
What do you mean? An image software is good enough for that.
Click to expand...

Nope, a forensic cloner tries a lot harder to get the what data
is available from bad sectors, it doesn't just ignore bad sectors.
A hardware write-blocker may be used in addition, you can get
them in various places. However, if you use, e.g. dd_rescue
from Knoppix, it does a read-only mount and writes nothing
to the disks.
Click to expand...
Do you want a hardware cloner?
Nope.

If you do, take care that you typically still need to
record image size and hash by using a computer.
Click to expand...

No you don't if you just want to use the copy to get what data you can.
 
Nope, a forensic cloner tries a lot harder to get the what data
is available from bad sectors, it doesn't just ignore bad sectors.
Click to expand...

A data-recovery outfit will do that, but forensic cloners
do ordinary disk accesses. Incidentially, the disk itself tries
pretty hard, if that fails, there likely is no way around
opening the drive.

Anyways, forensict will typically ignore defective sectors
as they are usually not needed and typically provide no proof
value. After all, you have to guess what is in there. That is
spy-stuff.
No you don't if you just want to use the copy to get what data you can.
Click to expand...

Huh? Forensics! That means chain-of-custody, demonstrating
that the copy and original are the same, etc..

Are you sure you understand what you are talking about?

Arno
 
A data-recovery outfit will do that, but forensic cloners do ordinary disk accesses.
Click to expand...

That's still better than just ignoring bad sectors.
Incidentially, the disk itself tries pretty hard, if that fails,
there likely is no way around opening the drive.
Click to expand...

That's just plain wrong.
Anyways, forensict will typically ignore defective sectors as
they are usually not needed and typically provide no proof value.
Click to expand...

That's just plain wrong.
After all, you have to guess what is in there. That is spy-stuff.
Click to expand...

Trying to get the data out of a bad sector instead of just ignoring it isn't.
Huh? Forensics! That means chain-of-custody, demonstrating
that the copy and original are the same, etc..
Click to expand...

Not when used to do what he wants to do.
Are you sure you understand what you are talking about?
Click to expand...

Yep, and you clearly don't.
 
Woger said:
dd from any distribution of Linux...
Click to expand...


Only does a Simple copy, has no Forensic Cloner features.[/QUOTE]

dd actually is a forensic cloner or can be used as one. Have a
look into the forensics literature...

Arno
 
In message <[email protected]> Woger
Only does a Simple copy, has no Forensic Cloner features.
Click to expand...

The problem here is that you're not using words that mean anything
specific.

In a normal forensic situation, bad sectors are ignored completely, what
is needed is the data on the drive which is actively being used.

If you want something that will make more of an effort to access bad
sectors, say that rather then making us guess what you might mean.
 
DevilsPGD said:
In message <[email protected]> Woger
Click to expand...
The problem here is that you're not using words that mean anything
specific.
Click to expand...
In a normal forensic situation, bad sectors are ignored completely, what
is needed is the data on the drive which is actively being used.
Click to expand...
If you want something that will make more of an effort to access bad
sectors, say that rather then making us guess what you might mean.
Click to expand...

Indeed. Using large words to sound impressive. Obviously not
understanding these words. Teenager-level tricks.

Arno
 
Back
Top