Notifications
Clear all
Topic starter
17/02/2008 7:44 am
In forensics investigation, is it better to work on bit-stream image rather than a copy made by bit-level disk-to-disk copy?
Why or why not?
17/02/2008 12:24 pm
As far as investigation is concerned, you'll have exactly the same results (as far as I know…)
However, bitstream images (depending on the format you use) are a lot more practical. They can be split, moved from a drive to another and some formats allow to locate precisely enough any error.
19/02/2008 5:15 am
Specific disk to disk copies…wow I haven't done those since I used safeback.
There's really no reason to do a disk to disk copy anymore. The majority of tools are designed to work with images of disks(although they will obviously take a physical disk).
Images are more portable and they are easier to archive.