KF, Is that a financial decision? Anyone can purchase EnCase.
You can mirror it with DD, if you are familiar with it, it is free. Best bang for the buck for imaging a drive, and recovering files and even partitions is R-tools r-tt.com: You would want Drive Image ($49) http://www.drive-image.com/ and R-UNDELETE ($55) http://www.r-undelete.com/. If you need to do the recovery across a network R-studio is ($179) Look here at the bottom of the page to see what each can do: http://www.data-recovery-software.net/ Cheers! __________________________________________________ Dave Kleiman, CAS,CIFI,CISM,CISSP,ISSAP,ISSMP,MCSE www.SecurityBreachResponse.com www.ComputerForensicInvestigations.com > -----Original Message----- > From: KF (lists) [mailto:[EMAIL PROTECTED] > Sent: Sunday, September 11, 2005 22:01 > To: [email protected] > Subject: Re: [Full-disclosure] Forensic help? > > http://www.sleuthkit.org/ > > I am not sure how courtroom safe it is. I have had someone > suggest to me that choosing sleuthkit was not sanctioned by > the xyz blah blah court of bleh (suggesting to use encase instead). > > As a private individual obviously encase is most likely not an option. > -KF > > > Red Leg wrote: > > >Hi all. > > > >I was wondering if anyone knows of a program/system that I can > >purchase, as a private individual, that will allow me to > > > >1) mirror a hard drive on location and > > > >2) take that mirror and restore it to another drive. And > > > >3) Find any CONVENTIONALLY erased files? > > > > -- This would be either a Windows NTFS or FAT32 drive. > > > >Anyone have first hand experience? Please let me know, if you do. In > >ANY case, please suggest whatever you might have learned > even without > >first hand experience. > > > >Thanks! > > > >Redleg18 > > > > > >_______________________________________________ > >Full-Disclosure - We believe in it. > >Charter: http://lists.grok.org.uk/full-disclosure-charter.html > >Hosted and sponsored by Secunia - http://secunia.com/ > > > > > > > > > > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
