You can image in "realtime" using a tool like FTK Imager. For best results you are best imaging the drive without the native OS running e.g. using a boot CD like Helix since actively using the disk could result in the data you want to recover being overwritten. It's a balance against the value of the data versus the disruption of shutting the machine now.
Jim 2010/1/19 Monkey Daemon <[email protected]> > So can I image the partition in "realtime" or do I need to take the > server off-line and boot from a live cd? > > MWD. >
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
