Announcement

Collapse
No announcement yet.

Creating a drive image from "within" OSForensics

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Creating a drive image from "within" OSForensics

    Sorry for all the questions David, but one last question if i may...
    1) If i mount a drive (Suspect) to my machine

    2) Re-start my machine and it shows , lets say Drive "F" (Suspect)...Will the internal "create drive image" of OSForensics be able to clone drive "F" include slack space, or not?

    I know OSFClone can do it, but it takes ages to complete...

  • #2
    Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

    Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effectively a bit for bit copy.

    Comment


    • #3
      Originally posted by David (PassMark) View Post
      Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

      Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effective a bit for bit copy.
      Thanks David...that answered my question 100%

      Comment

      Working...
      X