Notifications
Clear all
Topic starter
26/05/2007 11:07 pm
Hello,
I am practicing my forensics work by imaging and carving out images on hard drives. I have just imaged a hard drive that has 2 linux partiions (x83) and one linux swap (x82). My question is, if I am going to be recovering files (say I don't know what I am looking for - or even if I do) is it best to carve out each partition (both linux partitions & then the swap) or should I do the work all on the one physical drive? I am not sure if it would be easier to do the individal partitions b/c they are smaller? OR the main physical drive b/c I might miss something.
Thanks for your help in advance.
mark
Topic starter
26/05/2007 11:26 pm
I think that I answered my own question and that it is best to carve them out.
Thanks.
Mark