Important note: a sector-by sector image (known also as bit-stream image) is different from performing a copy of the disk using standard windows copy/paste function, as this will not copy hidden data and slack spaces. Let us first describe what we mean by a drive image copy, a disk image is a file that contains the exact same data and structure information as the original one, we can have this image through performing a sector-by sector image copy of the original disk, in this way we perform a replication of the same original disk.
The first thing we need to do when conducting computer investigations is to have a copy of the suspect drive, in this tutorial Iam going to show you how to use ProDiscover basic software tool to acquire and analysis a suspect drive. Windows XP, Vista, Win 7, server 2008 (all versions)Īll Windows based file systems including FAT 12/16/32/exFAT and NTFS Dynamic disks in addition to file systems such as SUN Solaris UFS and Linux Ext 2/3/4, and Mac OSX HFS+
0 kommentar(er)
