Re: Forensic help?

[Red Leg <redleg18 () gmail com>]

On 9/11/05 6:33 PM, "Red Leg" <redleg18 () gmail com> wrote:

> Hi all.
>
> I was wondering if anyone knows of a program/system that I can purchase, as
> a private individual, that will allow me to
>
> 1) mirror a hard drive on location and
>
> 2) take that mirror and restore it to another drive. And
>
> 3) Find any CONVENTIONALLY erased files?
>
>  -- This would be either a Windows NTFS or FAT32 drive.


Wow!

Thanks all. I really appreciate the education!

I wish that I could keep the target drive, and change it out. However, this
is a Freedom of Information Act issue. I don't think they'll let me keep the
original/target.


I knew about Drive Image, but I didn't know it or Symantec Ghost would be
able to get the erased data (as in using the "Delete Key" or right click
delete).

Thanks!
Redleg18


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/