RE: Preserving evidence

From: Christopher L Brown (clbrownat_private)
Date: Fri May 03 2002 - 07:37:17 PDT

  • Next message: Burnette, Michael: "RIM (BlackBerry) Forensics"

    > However by doing dd with appropriate settings surely you can 
    > preserve all
    > slack space onto the tape and then reconstruct the disk image when
    > convenient.
    
    Indeed, better than a straight backup to tape. 
    
    >> Understanding that you would lose all slack space by this process and
    >> only be preserving "files" your procedure is sound. Most expert
    
    Christopher L. T. Brown
    Technology Pathways LLC
    clbrownat_private
    Phone: 619-435-0906
    http://www.TechPathways.com
    ---------------------------
    PGP FP: 
    0731 B5B1 A9B1 8D85 E7FC 
    F14A B5D2 FDCF 5CBD A4AE
    
    
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri May 03 2002 - 08:39:14 PDT