1. The suspected hard drive is aroound 40GB, and I have been having errors writing more than 4GB on FAT32 forensically wiped hard disk.
Should I wipe the imaging hard disk as FAT32 then go on Partition Maker on Helix and change the partition to NTFS and then mount it as NTFS-3g which is the writable format of NTFS?
Will I be able to image the 40GB suspected hard disk on FAT 32 forensically wiped 80GB hard disk?Sorry to bother u so much, but thank you very much for being so supportive.
1. You and everyone else. The maximum file size for Fat32, is 4gb.
You could always set your segment size to < 4gb, in fact, if you choose to backup to DVD, there is a size, just over 2gb which is optimal for this, where you can get 3 segments per DVD.
Thank you very much.
So I will wipe the hard disk using EnCase
then using Partition Manager in Helix change the partition of the wiped hard disk to NTFS
But, how to make this hard disk NTFS-3g which is writable format and then how to mount it as read-write for imaging.??
Do we use the following command
mount -t ntfs-3g /dev/sdb /media/sdb -o force
mount -t captive-ntfs -o rw /dev/sdb /mnt/sdb
Many thanks to all!