Anybody care to share there challenges from getting a forensic image from laptop notebook hard-drives? I've only done a few but the traditional methods of extracting the disk and using a write blocker has been relatively unsuccesful, and I also find, probably due to the nature that there tends to be lots of bad sectors. Anyone else got any stories? Or tips perhaps?
I've done tons of notebooks, and never had a problem extracting and using a WB.
If you find yourself having problems you may have to use a crossover cable and an encase boot disk.
Really daft question but have you a document link for the crossover cable?
Im only yet to use live acquisition or a write blocker, not the boot cd, ive heard of linen though.
Greetings,
I've done this with both a standalone disk duplicator (DiskJockey) and with FTK Imager and a write blocker (NoKey FPU). Worked flawlessly each time.
-David
Paulo,
The crossover cable is just a UTP CAT 5 cable with the green and orange pair crossed at one end. You get one in the box with EnCase but they are £1 from any online IT supplies company.
As for laptop disks. We always try to remove the disks if we can. If for some reason we can't then we would go with either EnCase boot disk via crossover or with a live CD like Helix or SPADA. This in-situ imaging is a last resort though. As for bad sectors I haven't noticed much difference than with 3.5" disks.
Steve