Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since foremost/sleuthkit seem to require a disk image, I created one using clonezilla. However, I realized afterwards that it "saves and restores only used blocks in the harddisk".

Does that mean it won't save any blocks were files used to be, but have been deleted? Or will it still copy all sectors with some sort of data on them? i.e. should I still be able to find any deleted files on the clonezilla image or not?

(related questions: How else can I create a full disk image for deleted file recovery? Can I use Sleuthkit/Foremost directly on a physical disk?)

share|improve this question
I think the best way to make an as-is image would be using dd. – slhck Apr 22 '13 at 10:27
If I use dd, any specific blocksize and other stuff I should specify? Or can I just run dd if=/dev/sda of=/extHD/sda.img? I would like to reduce the time as much as possible, since the disk is about 220GB big. – KIAaze Apr 22 '13 at 10:35
up vote 2 down vote accepted

Nope. Clonezilla won't save tge blocks that used to exist. It will backup all the present data only.

share|improve this answer
Ok, a whole evening creating the image wasted then. :( Thanks. – KIAaze Apr 22 '13 at 10:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.