Hello,
I have a drive with one imaged system split into many different dd image all = one. If I hook up the drive to an analyst machine to copy over those dd images w/ out a write blocker will the dd images be written to at all? Meaning when they are moved over the dd images should still have the same md5 from acquisition.
Is that correct?
Thanks
Providing no errors occur during the copying, yes. The md5 being your check that they're the same.
Mandjw,
Did someone tell you that this wasn't the case? I mean, thinking logically, it wouldn't be very useful if files (in general) being copied were arbitrarily changed in some way. Besides, analysts should never conduct their work on the original image, but instead a copy…all you need to do is make the copy and then verify the copied file(s) w/ an MD5 utility.
Well, this brings back memories, but I remember the old DEC-10 systems which were 36-bit rather than 32-bit. You had to be careful moving files back and forth because the system would "pad" file transfers.