RE: Copying HDDs for forensic purposes?

["Hunt, Jim" <Jim.Hunt () nwsc k12 in us>]

Ghost does forensic copies of the Hard Drives -
http://service1.symantec.com/SUPPORT/ghost.nsf/pfdocs/1999110813413225?O
pen&dtype=corp 

Jim Hunt
Certified Network & Systems Engineer
Northwestern School Corporation
Technology Services Manager
http://technology.nwsc.k12.in.us

http://www.ProWinHost.com | Professional Windows Hosting | Professional
Windows Reselling
http://www.AlertServ.com | Managed and Incident Windows Server Support |
Custom Alerting
http://www.NetMon.org | Network Monitoring Tools and Tutorials |
Includes MRTG for Dummies

-----Original Message-----
From: Spencer D'oro [mailto:sdoro () comcast net] 
Sent: Saturday, November 15, 2003 1:09 PM
To: security-basics () securityfocus com
Subject: Copying HDDs for forensic purposes?

Hello to all,

I am interested in forensic examinations of hard drives.  In the little
material I have seen, the authors state that no examination should be
made
of an original device; that instead a copy should be made and all
examinations made to that device.  My question is this:  If you make a
copy
of the hard drive, does it copy the sectors that had recently deleted
files
or does it just mark them as blank in the partition table of the new
drive?
What if the source is physically damaged?  Or do you need a special
utility
to get the "erased" data?  Thanks in advance for the help.

Spencer


------------------------------------------------------------------------
---
Forum Systems PRESIDIO: PGP / XML GATEWAY APPLIANCE
The Presidio integrates PGP data encryption and XML Web Services
security to 
simplify the management and deployment of PGP and reduce overall PGP
costs 
by up to 80%.
FREE WHITEPAPER & 30 Day Trial - 
http://www.securityfocus.com/sponsor/ForumSystems_security-basics_031027

------------------------------------------------------------------------
----




---------------------------------------------------------------------------
Forum Systems PRESIDIO: PGP / XML GATEWAY APPLIANCE
The Presidio integrates PGP data encryption and XML Web Services security to
simplify the management and deployment of PGP and reduce overall PGP costs
by up to 80%.
FREE WHITEPAPER & 30 Day Trial -
http://www.securityfocus.com/sponsor/ForumSystems_security-basics_031027
----------------------------------------------------------------------------