Date sent: Wed, 20 Mar 2002 01:41:30 -0500 From: rsgilmoreat_private To: "forensicsat_private" <forensicsat_private> Subject: Re: Encase and data recovery I'm afaid not. "Copy-II-PC" ran as a DOS application. I'm suggesting a totally OS-free system using a few kB of dedicated machine code. The reason is that even a DOS environment could be contaiminated by doing other things with the platform. A one-job machine stays clean much more *demonstrably*. Remember that forensics is not just about being right- it's about being right *and convincing*, and your most important audience (the jury) normally hasn't a clue what you're talking about technically. I don't know them myself, but another correspondent has mailed me with two potential tools "the Solo <http://www.ics-iq.com/html/forensics.html> and Solitaire <http://www.logicube.com/store/solitaire_turbo.html> disk duplicators." Thanks to Buck at CSC.COM for this. Mike > > Hmmm... a HD version of the old DOS floppy-copy utility > "Copy-II-PC" ??? > > > "Michael D. Barwise, BSc, IEng, MIIE, MBCS" wrote: > > > My ideal disk copier would be a very basic PC... with a truly blank > > target disk and a spare port, running nothing except a custom-written > > native application which does nothing except read literal sectors from > > one hard disk to another (no OS). > --- > [This E-mail was scanned for viruses by http://www.intouchmi.com] > > > ----------------------------------------------------------------- > This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Mar 21 2002 - 07:33:14 PST