Re: Imaging a PCMCIA flash card?

From: M. Oosterink (bugtraqat_private)
Date: Thu Aug 01 2002 - 14:44:15 PDT

  • Next message: Stephen Samuel: "Re: need further help with break in"

    Hello Mike,
    
    Wednesday, July 31, 2002, 4:33:05 PM, you wrote:
    > Are there any tools or proceedures for getting a raw image to and from a
    > PCMCIA flash card?
    
    If PCMCIA flash cards are alike compact flash cards (and I see no
    reason why they shouldn't be), you can use any tool you favour as long
    as the OS you're using recognizes the card properly.
    
    Best support for the card is probably availlable for Windows, so that
    is probably the easiest way (with the proper tools). Encase for instance,
    should have no trouble imaging the card, nor putting an image back. This
    ofcourse is if you are doing forensic work. I've had success with
    compact flashcards and Encase in a number of cases (yes, also reading
    slackspace).
    
    For just reading and writing (raw) images of the card, dd (or its
    Windows counterpart) will probably do the trick just fine. As an
    example, some embedded systems such as routers use PCMCIA flash cards
    and their images can succesfully be coppied from and to the card
    using dd and Linux.
    
    Best regards,
    
    Maarten Oosterink
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Thu Aug 01 2002 - 18:36:19 PDT