Full Disclosure mailing list archives
Re: Forensic help?
From: als () thangorodrim de
Date: Mon, 12 Sep 2005 17:02:04 +0200
On Mon, Sep 12, 2005 at 10:11:24AM -0400, Red Leg wrote:
On 9/11/05 8:21 PM, "Paul Schmehl" <pauls () utdallas edu> wrote:Download the knoppix std distro and burn it to a cd. Use dcfldd for drive imaging and the forensics tools for recovery of erased files and the like.Paul. Does dcfldd allow me to mirror the disk in such a manner as to include deleted files? I can not swap drives. I need to obtain an image with which I can "undelete" files that were conventionally erased. Will dcfldd provide such an image?
I haven't used dcfldd, but it seems to be a modified version of the standard UNIX tool dd. As such it should produce a block level image of the disk - which includes everything on the disk, deleted or not. Regards, Alex. -- "Opportunity is missed by most people because it is dressed in overalls and looks like work." -- Thomas A. Edison _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Forensic help?, (continued)
- Re: Forensic help? KF (lists) (Sep 11)
- RE: Forensic help? dave kleiman (Sep 11)
- Re: Forensic help? Jason Coombs (Sep 11)
- Re: Forensic help? Paul Schmehl (Sep 11)
- Re: Forensic help? Red Leg (Sep 11)
- Re: Forensic help? Red Leg (Sep 12)
- Message not available
- Re: Forensic help? Ragone_Andrew (Sep 12)
- Re: Forensic help? KF (lists) (Sep 12)
- Re: Forensic help? fd (Sep 12)
- Re: Forensic help? Paul Schmehl (Sep 12)
- Re: Forensic help? als (Sep 12)
- Re: Forensic help? KF (lists) (Sep 11)
- Re: Forensic help? Andrew Farmer (Sep 11)
- Re: Forensic help? James Wicks (Sep 12)
- Re: Forensic help? Nick FitzGerald (Sep 12)
- Re: Forensic help? Paul Robertson (Sep 16)
- Re: Forensic help? KF (lists) (Sep 12)