I'm trying to copy an image of a 80gb harddrive to my 160gb mypassbook USB external drive. I'm using FTK Imager and it just never really gets pas the beggining. Just says drive is full. But there is nothing on the drive itself. I didn't wipe the drive before trying to do this, should i? Any recommendations on what to use to do this? Also what should be the best format .E01 or DD, and fragment size if i'm just putting this on a another drive.
Perhaps the drive full error is masking a permission issue.
The best format is surely a topic for discussion, but I would say the format you choose should be the one that all your examination programs use. For example if not all your programs can see EnCase files then choose DD. Also, if you have space issues, the compression feature of EnCase files could be of use (of course that brings into play speed of capture issues).
Perhaps the drive full error is masking a permission issue
I think that's a good place to start, I've run into something similar a number of times (admittedly not with FTK per se, but with imaging under Linux). Check permissions, filesystems, mounting, etc.
Jamie
what does DIR <drive letter> show?
Volume in drive K is MY STUFF
Volume Serial Number is 3475-DC0F
Directory of K\
…
20 File(s) 3,170,726 bytes
3 Dir(s) 53,981,184 bytes free
debaser you hit the nail on the head. It was formated fat32. I converted it to ntfs and now it worked no problem. Thanks.