Although this post relates to a Psion Revo this concept is equally relevant to any other PDA (Palm, Handspring, Compaq iPaq, HP Jordana etc). Does anyone know if it possible to make a complete copy of all of the data resident on a Psion Revo? When I have come across these previously I have used the following method: -> Install a new copy of Win9x on a drive that has been forensically wiped; -> Install PsiWin onto the Windows drive; -> Forensically wipe all free and slack space on the drive (again); -> Connect the Revo (or other Psion) to my workstation; -> Backup the Revo onto the Windows drive using PsiWin; -> Image the Windows drive. The problem with this is that a) there are potentially holes in the methodology, and b) (most importantly) this method only captures active data. I'm sure that there is a utility out there to create a complete image of all of the data held in the Psion (ie 16Mb of data from 16Mb of on-baord memory), but I can't find it. I suppose that an "interpreter" for the image would also be important, so that you know what data relates to active files, and whether the any deleted material could be "recovered". Can anyone suggest anything? Thanks Craig ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Aug 05 2001 - 09:54:30 PDT