RE: raw disk access
The best that can be achieved is via 'dd'.
however it is actually impossible to get _real_ raw disk access due to the
disk IO controllers. As far as I know, all disk IO controllers have
automatic data correction etc and so do hard disks. An accurate copy of the
surface of the disk cannot be gained by this method.
Has anyone any ideas on whether it's possible to bypass the automatic checks
performed by the IO controllers?
Colin
Solution City Ltd
http://www.solution-city.com
-----Original Message-----
From: viv [mailto:viv@veeev.com]
Sent: 07 January 2003 21:08
To: DebianSecurity
Subject: raw disk access
Hi.
As a Debian user, i am posting to this list first in the hopes
that what i am looking for can be found as a Debian package.
i am looking for forensics tools that can be used in computer
crime investigations, and am particularly interesting in a tool
that provides raw drive (hard, floppy, CD, DVD, etc.) access in
order to create complete and accurate drive images.
If such a tool does not exist within Debian, is anyone aware of
any application (GPLed, please) that does? Failing that, i am
willing to write my own tool, if necessary, and would appreciate
any pointers to good reference material (raw drive access and
how to work with the images created).
If it helps, i am running with the latest 'unstable' packages.
Many thanks.
--
viv <viv@veeev.com>
Reply to: