SV: Copying HDDs for forensic purposes?

[Thomas Westlund <thomas.westlund () prioritytelecom no>]

Hi,

There are lot's of tools to let you clone HD. I think Norton's Ghost copies
the drive sector sector exactly as it is.
I haven't checked into this, but It's a cloning program, so that's what it
should do :)

-- 
Thomas Westlund
Priority Telecom Norway AS 



-----Opprinnelig melding-----
Fra: Spencer D'oro [mailto:sdoro () comcast net]
Sendt: 15.11.2003 19:09
Til: security-basics () securityfocus com
Emne: Copying HDDs for forensic purposes?


Hello to all,

I am interested in forensic examinations of hard drives.  In the little
material I have seen, the authors state that no examination should be made
of an original device; that instead a copy should be made and all
examinations made to that device.  My question is this:  If you make a copy
of the hard drive, does it copy the sectors that had recently deleted files
or does it just mark them as blank in the partition table of the new drive?
What if the source is physically damaged?  Or do you need a special utility
to get the "erased" data?  Thanks in advance for the help.

Spencer


---------------------------------------------------------------------------
Forum Systems PRESIDIO: PGP / XML GATEWAY APPLIANCE
The Presidio integrates PGP data encryption and XML Web Services security to

simplify the management and deployment of PGP and reduce overall PGP costs 
by up to 80%.
FREE WHITEPAPER & 30 Day Trial - 
http://www.securityfocus.com/sponsor/ForumSystems_security-basics_031027 
----------------------------------------------------------------------------

---------------------------------------------------------------------------
Forum Systems PRESIDIO: PGP / XML GATEWAY APPLIANCE
The Presidio integrates PGP data encryption and XML Web Services security to 
simplify the management and deployment of PGP and reduce overall PGP costs 
by up to 80%.
FREE WHITEPAPER & 30 Day Trial - 
http://www.securityfocus.com/sponsor/ForumSystems_security-basics_031027 
----------------------------------------------------------------------------