duplicators which c...
 
Notifications
Clear all

duplicators which can image without removing hard drive

9 Posts
9 Users
0 Likes
1,022 Views
(@taneryldz)
Posts: 1
New Member
Topic starter
 

Hi, i am a technician at a forensic firm. İ am a newbie in this area so look with favor on my ignorance. We are looking a device which can copy hard disk of a computer without removing computer's hard disk. İ searched for a lot but all duplicator requires directly connecting hard disk via its sata or ide port. We cannot remove source hard disk from computer. We can reach USB port or any ohter interface of source computer and we want to obtain whole clone its hard disk. Device should copy hard disk as soon as possible. Source computer can be powered off or on, its not important. Write protect is not very critical for us. Are there any duplicator or tool that can manage this work. If not, can you suggest a solution. We stronly need a solution to do this work. Any suggestion would be very appreciated, thanks a lot.

 
Posted : 17/05/2013 9:30 pm
(@athulin)
Posts: 1156
Noble Member
 

We are looking a device which can copy hard disk of a computer without removing computer's hard disk. İ searched for a lot but all duplicator requires directly connecting hard disk via its sata or ide port.

That's what duplicators do. They are separate devices, so they need to connect to the HDDs.

We cannot remove source hard disk from computer. We can reach USB port or any ohter interface of source computer and we want to obtain whole clone its hard disk. Device should copy hard disk as soon as possible.

I know of no 'device' that works.

Source computer can be powered off or on, its not important. Write protect is not very critical for us. Are there any duplicator or tool that can manage this work. If not, can you suggest a solution.

Use some kind of forensic imaging software, or similar tool. For example, if you're running Windows, something like FTK Imager Lite would probably do the job. If you're using x86, and are OK with rebooting from a CD, try Helix3 (e-fense), Raptor (ForwardDiscovery) or similar solutions. (There are also solutions for Mac and other platforms) if you don't need a full forensic image, you can probably get by with one of the usual drive image tools. If you have a forensic analysis platform already, it may have add-on modules to provide remote acquisition over networks.

 
Posted : 17/05/2013 10:00 pm
(@armresl)
Posts: 1011
Noble Member
 

What's up there Taney?

Use any flavor or Linux boot disk, or boot to a USB thumb drive with an imagine program on.

All you'll need is to look up "forensic boot disk" and pick the one you feel most comfortable with. Then linen, air, dd, all become available to you and you can image whatever you need.

 
Posted : 18/05/2013 12:23 am
(@mscotgrove)
Posts: 938
Prominent Member
 

I would suggest you try one the ideas above - eg booting from Linux DVD or similar.

Do not be temped to copy any new software onto the 'suspect' drive as this can overwrite deleted files that may be critical to your investigation. Just to be safe, also disconnect the network cable while working.

For some devices, such as some of the Apple Airbooks that have 'soldered in' hard drives, this approach is the only way

 
Posted : 18/05/2013 2:36 pm
binarybod
(@binarybod)
Posts: 272
Reputable Member
 

Hi, i am a technician at a forensic firm. İ am a newbie in this area so look with favor on my ignorance. We are looking…

So there is no-one at this forensic firm who can answer this most basic of questions. I would just love to be on the opposing side when any member of this firm came to court (adversarial court systems only).

BTW taneryldz, I have no issue with your ignorance, everyone has to start somewhere. I just hold my head in my hands when I hear that a firm offering digital forensics as a service can't even do something as basic as this… Its like saying "We are a company of mathematicians but we are stumped because our client asked whether the sum of 2 and 2 is the same as the product, can anyone help us?"

All the preceding advice is good -)

Paul

 
Posted : 19/05/2013 1:39 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Write protect is not very critical for us.

May I ask what is the scope of the imaging if not that of having a surely not modified image? ?

jaclaz

 
Posted : 19/05/2013 4:20 pm
(@georgefan)
Posts: 27
Eminent Member
 

Hi, i am a technician at a forensic firm. İ am a newbie in this area so look with favor on my ignorance.Are there any duplicator or tool that can manage this work. If not, can you suggest a solution. We stronly need a solution to do this work. Any suggestion would be very appreciated, thanks a lot.

Logicube products such as Dossier and Talon Enhanced can do that

 
Posted : 19/05/2013 6:28 pm
paninik
(@paninik)
Posts: 9
Active Member
 

Perhaps use a Live USB/CD with a forensic distro like DEFT?

 
Posted : 28/05/2013 8:28 am
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Can you provide more details about the equipment?

Hi, i am a technician at a forensic firm. İ am a newbie in this area so look with favor on my ignorance. We are looking a device which can copy hard disk of a computer without removing computer's hard disk. İ searched for a lot but all duplicator requires directly connecting hard disk via its sata or ide port. We cannot remove source hard disk from computer. We can reach USB port or any ohter interface of source computer and we want to obtain whole clone its hard disk. Device should copy hard disk as soon as possible. Source computer can be powered off or on, its not important. Write protect is not very critical for us. Are there any duplicator or tool that can manage this work. If not, can you suggest a solution. We stronly need a solution to do this work. Any suggestion would be very appreciated, thanks a lot.

 
Posted : 28/05/2013 5:43 pm
Share: