2

I have a 100GB NTFS-formatted drive, and a 250GB external USb disk.

I am thinking of using a live disk, as is described here, except that I will skip the gzip part.

http://www.hanckmann.net/?q=node/19

I have enough space. I just want to back up EVERYTHING (including recoverable deleted files) for forensic purposes. That is why gzip is more of a nuisance in this case (I think).

Anyhow, if I use this command:

sudo dd if=/dev/hd_ > /mnt/hd__/image_name.dd

Will this save EVERYTHING, or just the healthy and existing directory structure?

Also, what is the easiest way to mount that image later on: A) Mac OS Leopard B) Windows XP / Vista / 7?

Free versions of software are preferred, but I will consider shelling out some $ if the product is amazing.

Thank you and Happy New Year!

Improve this question
3
  • 2
    Make sure the USB disk is not formated as FAT32 - FAT32 has a 4GB file size limit.
    – Macha
    Jan 1, 2010 at 18:27
  • I just bought it ... not sure which partition is on it yet. Can Linux write to NTFS partition reliably? I remember a few years back NTFS had read-only support. Since I will be giving the disk to a (mot likely) Windows user, I want to make it easy for them or else I will have to pay extra.
    – Fantomas
    Jan 1, 2010 at 18:33
  • 1
    Yes, the dd command copies everything. If you image a harddrive using it, it saves every file, as well as boot flags and partition structure.
    – Elle H
    Jan 1, 2010 at 18:36

5 Answers 5

Reset to default
2

dd is the best way to do this. While the method you posted will technically work (which not output file is specified, dd sends the output to shell). It would be better, as Wil says, to use sudo dd if=/dev/hdX of=/dev/hdY Not that the disks could also show up as /dev/sdX. If you're not sure which disk is which, type sudo fdisk /dev/hdX, and press p to print the partition table for that device.

dd does a bit-by-bit copy, it produces a forensically sound image, so any recoverable files will be there.

One of the best tools to mount the image on Windows that I've found is WinHex, it lets you browse as a normal disk, and has some data recovery features. However, GetDataBack (NTFS) has much better recovery, and it can also access image files.

Improve this answer
2
  • Thanks ... if only I had 15 reputation, I would vote up myself. For clarification: when I use the of option, can I send the output to a file on a partition (USB ext disk) and not to the partition itself (if that makes sense)?
    – Fantomas
    Jan 1, 2010 at 18:23
  • 1
    If you mount the USB disk, then you can send the output there. sudo if=/dev/hdX of=/mnt/usb/disk.img would work fine.
    – Dentrasi
    Jan 1, 2010 at 20:50
2

I would recommend the easiest thing you can do is simply to use Gparted, and do copy from the original partition and paste it to the USB drive.

When you click apply, it should do a 1:1 copy and work fine!

However, to your original question, I am not an expert using dd, but I would have thought you need...

sudo dd if=/dev/hd_ of=/mnt/hd__/image_name.dd

Improve this answer
2
  • Thanks ... will Gparted preserve deleted but recoverable files if any? Any info on mounting the partition under Windows?
    – Fantomas
    Jan 1, 2010 at 17:50
  • 1
    OK... I understand what you want to do now - You want a sector by sector copy - I am really sorry, I have used gparted hundreds of times, but not for what you want - I know it works well, but I have never tested it for what you want. For this sort of thing, I use r-studio and create a sector level backup from there.... I think DD may do what you want then.
    – William Hilsum
    Jan 1, 2010 at 18:03
1

if you want to preserve the drive content for further forensic examination, i recommend EASEUS Disk Copy, a potent freeware providing sector-by-sector disk/partition clone regardless of your operating system.

and speaking of forensics, there's nothing better than WinHex, a 1 year personal license is pretty reasonable too (€39.41).

since it is a NTFS partition, there's no reason why you shouldn't be able to mount it in Windows, however, i would not recommend it, because Windows my write information to the drive which may make forensic examination even harder, use WinHex from a BartPE CD/USB stick instead to avoid any writing.

Improve this answer
1
  • Thank you, good to know. I sort of know my way around Linux, so I do not mind booting up with a Live CD - seems like a safer option a well, knowing that I can mount the source drive as read-only.
    – Fantomas
    Jan 1, 2010 at 18:26
0

I'm a bit surprised that nobody mentioned CloneZilla -- what doesn't it do that the OP needs?

Improve this answer
1
  • 1
    you wouldn't need Clonezilla, as sector copy in Clonezilla is done by DD anyway.
    – Molly7244
    Jan 1, 2010 at 19:24
0

I'd note there's forensics specific livecds such as deft, and forensic DD varients such as DFCLDD. Don't forget to do checksums too. As far as methods go, there's a good book by mandia and procise i believe that covers most of the process.

os x should mount images with the loop command. Windows needs additional software- filedisk comes to mind, but there's probably easier alternatives

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .