This is great practical information. Thanks for the replies. This is the sort of stuff that makes this a frequently visited web site for me.
Acquire via Firewire 800 or gig eth using crossover - no encryption needed. Output to a raw image file (in whole or segmented into chunks) to insure backward and forward compatibility for both forensic and non-forensic tools. Be careful of falling into any proprietary file format.
regards,
farmerdude
Acquire via Firewire 800 or gig eth using crossover - no encryption needed. Output to a raw image file (in whole or segmented into chunks) to insure backward and forward compatibility for both forensic and non-forensic tools. Be careful of falling into any proprietary file format.
regards,
farmerdude
By "raw image file" do you mean a DD image or just a clone of the suspect hard drive?
OldDawg,
A little slow in my reply …
Yes, a raw image, ideally sector matching sector, something akin to 'dd' (or its variants) or SMART for Linux. This raw format provides for maximum flexibility for analysis and backward and forward compatibility, as well as no restrictions or threats of legal sanctions (DMCA).
regards,
farmerdude