There are two methods one can utilize to duplicate the data without
tainting the identified subject's hard drive.
One is by www.dupeit.com, a IDE/SCSI Disk Duplication or the CMS Easy
Bundle PCMCIA cards, both are capable of doing byte by byte copies.
Once that is complete, the duplicated disk can be chunked up into 650MB
chunks then burned onto CD-ROM for impermeable storage and evidence.
It gets a little tricky when using different sized drives, but it works.
Use Norton Utilities to retrieve the unerased blocks, etc.
/m
"weird old drewbie " <[EMAIL PROTECTED]>
Sent by: [EMAIL PROTECTED]
04/14/00 07:02 AM
To: [EMAIL PROTECTED]
cc:
Subject: Off Topic: Forensics
We had an employee leave "under a cloud" a few months ago. Litigation is
pending.
The hard drive was removed from the employee's desktop computer and was
replaced before the computer was assigned to another employee.
Before leaving my finger and footprints all over the disk in the process
of retrieving the information wants, I need to make a backup copy of the
disk in the condition I received it.
This is a W98 system on a garden variety Intel desktop box.
There is too much I don't understand in this eviornment. I concerned that
reqular backup up and restore will dink with date information that may
become significant later.
I'm looking for a tool that will make a low level sector by sector copy of
the disk, preserving all OS datastructures.
I believe it should as a D:\ drive not a C:\ drive to keep the W98 from
running amok adjusting things that should be left alone.
Any other precautions?
Suggestions for a better place to ask these questions?
--== Sent via Deja.com http://www.deja.com/ ==--
Share what you know. Learn what you don't.
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
