Creating a drive image from "within" OSForensics

Collapse
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Marius
    Junior Member
    • May 2012
    • 8
    #1

    Creating a drive image from "within" OSForensics

    Sorry for all the questions David, but one last question if i may...
    1) If i mount a drive (Suspect) to my machine

    2) Re-start my machine and it shows , lets say Drive "F" (Suspect)...Will the internal "create drive image" of OSForensics be able to clone drive "F" include slack space, or not?

    I know OSFClone can do it, but it takes ages to complete...
    Tags: None
    • David (PassMark)
      Administrator
      • Jan 2003
      • 11092
      #2
      Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

      Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effectively a bit for bit copy.

        Comment

        • Marius
          Junior Member
          • May 2012
          • 8
          #3
          Originally posted by David (PassMark)
          Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

          Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effective a bit for bit copy.
          Thanks David...that answered my question 100%

            Comment

            Previous template Next
            Working...