Notifications
Clear all

Is it better to....

2 Posts
1 Users
0 Reactions
476 Views
(@mwade)
Trusted Member
Joined: 18 years ago
Posts: 77
Topic starter  

Hello,

I am practicing my forensics work by imaging and carving out images on hard drives. I have just imaged a hard drive that has 2 linux partiions (x83) and one linux swap (x82). My question is, if I am going to be recovering files (say I don't know what I am looking for - or even if I do) is it best to carve out each partition (both linux partitions & then the swap) or should I do the work all on the one physical drive? I am not sure if it would be easier to do the individal partitions b/c they are smaller? OR the main physical drive b/c I might miss something.

Thanks for your help in advance.

mark


   
Quote
(@mwade)
Trusted Member
Joined: 18 years ago
Posts: 77
Topic starter  

I think that I answered my own question and that it is best to carve them out.

Thanks.

Mark


   
ReplyQuote
Share: