On 06/06/10 16:45, Andrea Conti wrote: >>> 1- if the root partition is [part of] what you're copying, you >>> *must* mount it read-only (mount -o ro /dev/sdc /work) >> >> Not from my experience; I simply mount, exec, and go - Works fine > > Let's say you are 50% done copying a partition, when something > writes to it. If the write only affects the first half, which has > alredy been copied, the target will consistently reflect the "old" > state; if on the other hand the write only affects the second half, > which has not been copied yet, the target will consistently reflect > the "new" state. The problem is that with any write affecting both > halves your copy will contain a mix of the two states and thus will > be inconsistent.
Should that happen, I certainly agree that the copies would be inconsistent... but I don't know what would cause the live OS to write anything to it (other than update the last access date/time - which occurs early on). At any rate, should that happen, the hashes would disagree and I'd reject the copy. Thus far the whole-disk hashes have always agreed Now, if this were a forensic investigation, then you're absolutely right - even updating an access time would be unacceptable; regardless that the changed source and copied destination hash the same.
