On Fri, 14 Apr 2000, weird old drewbie wrote:
> I'm looking for a tool that will make a low level sector by sector copy of the disk,
>preserving all OS datastructures.
>
You can stick the drive in a Linux (or other x86 *nix machine that
understands VFAT) and mount the drive read only or just use dd to copy the
drive to do the discovery work.
> Any other precautions?
Document the chain of evidence and have a sheet of paper with custody and
date information (signed) on it that follows the drive around.
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
[EMAIL PROTECTED] which may have no basis whatsoever in fact."
PSB#9280
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
