Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

I have an external hard drive which I need to make an exact copy of, but I need to do so without leaving any trace of the operation on the original drive.

I'm primarily a Mac user, but I suspect the drive in question is formatted in FAT32, so if it would be easier to perform the operation in question, I have a Windows 7 platform as well.

My first question is, if I simply connect the external drive to my computer to check which file system is used on the drive, will this leave a record on the drive?

Second, what would be the best method of making a clone of this drive without leaving any sort of record on the drive itself? I was thinking originally of using Mac's Disk Utility to make a Disk Image of the drive. Would this work, or do you have a better suggestion using either Mac OS 10.7, or Windows 7?

NOTE: I should mention that I strongly doubt the Hard Drive in question will be subjected to any serious examination by professionals. I am more curious if the cloning would be evident to an average person using the tools available to them in either Mac OS X, or Windows 7?

share|improve this question
1  
Some specialised „data recovery” live-cd linuxes do not mount the disks when connected. – kinokijuf Jan 23 '12 at 19:09
@kinokijuf - Can this solution work on Mac OS X? – MacMan Jan 23 '12 at 19:12
I did not tell you of any solution. – kinokijuf Jan 23 '12 at 19:21
Or you can use specialist (expensive) forensic kits. – kinokijuf Jan 23 '12 at 19:22
@kinokijuf - Ok, so what you're saying is that with Disk Utility, what I am asking is not possible? I doubt the hard drive in question will be subjected to any serious forensic examination. I'm more curious if the operation would be evident to any of the layperson tools available on the mentioned operating systems? – MacMan Jan 23 '12 at 19:28
show 3 more comments

3 Answers

up vote 1 down vote

Symantec/Norton GHOST would allow you to do this on a Windows 7 system. It allows a "cold" image so there should be no trace on the external drive.

share|improve this answer
I'd recommend using one of several backup utilities from Hiren's Boot CD (Free) hirensbootcd.org/download – BloodPhilia Jan 23 '12 at 19:34
@Dave M - Thank you for your answer. I'm not sure if you read the "Note" I added to the question just a moment ago, but it explains that I doubt there will be any examination of the drive by a professional. I am looking for a method that will allow the clone to not be evident to a layperson using the tools available to them, i.e. examining when the last time the file was viewed for example (if you can think of any others...). I say this because if possible, I would like to stick with tools I currently have access to, and Norton is not one of them. Would Disk Utility leave a trail? – MacMan Jan 23 '12 at 19:36
up vote 1 down vote

Are you going to do this often (or are you rich)? There are hardware utilities that allow you to connect hard drives with write blockers between them, preventing absolutely any write operations on the HDD itself (at least those that might be initiated by your computer - the firmware of the HDD will still probably update internal values such as power on count and other SMART parameters). They are quite expensive for one-time use.

You don't need to be a professional to see these values - if you're paranoid and looking for it, you would notice.

Apart from that something like clonezilla is a nice free HDD cloning tool that should make things simple and safe. IF you want to pay, try Acronis TrueImage or Symantec GHOST.

share|improve this answer
up vote 0 down vote

It's possible that mounting a disk read/write could leave traces. On the Mac, you can use mount(8) or diskutil(8) to mount a disk read-only. But off the top of my head, I don't know how to get the Mac to not automount any new disk you attach. So the problem is getting the Mac to not automount it, so that you can then mount it read-only by hand.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.