Hello,
Thanks for your help in advance. What is the best method for copying hard drives? I know how to use dd, but if I want to take a hard drive and copy it with out it being a live image, what hardware can I purchase to duplicate the image (disk duplicator)? Also what is the best method for copying an image. Meaning, if I have a suspect hard drive and I have a linux system set up for research do I first duplicate the image (with what ever suggested hardware from my first question), then I have to put the newly copied image into a system for research, or is it at that point that I dd the image to my linux research system. My guess would be that at that point after I dupicate the image I insert the HD into a system and just do the research on that system.
Again thanks for your help.
mark
That's a wide open question. Some methods are faster than others, some are more reliable than others. As a general rule I prefer flexibility in acquisitions. Nothing works all the time and I like to have a backup, and a backup for that. Firewire write blockers are good, but I often fall back on linux or dos acquisitions as well. I haven't tried any of the stand alone imagers, but many people like those.