Creating a drive image from "within" OSForensics

[Marius]

Sorry for all the questions David, but one last question if i may...
1) If i mount a drive (Suspect) to my machine

2) Re-start my machine and it shows , lets say Drive "F" (Suspect)...Will the internal "create drive image" of OSForensics be able to clone drive "F" include slack space, or not?

I know OSFClone can do it, but it takes ages to complete...

[David (PassMark)]

Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effectively a bit for bit copy.

[Marius]

Just a comment on the machine restart. If the drive is a SATA drive, and your machine isn't too old then you should be able to hot plug it, without a restart.

Yes, you can clone a partition or a drive with OSF and yes, it will include all the file slack space and any unused disk space in the image. It is effective a bit for bit copy.

Thanks David...that answered my question 100%