3

Since foremost/sleuthkit seem to require a disk image, I created one using clonezilla. However, I realized afterwards that it "saves and restores only used blocks in the harddisk".

Does that mean it won't save any blocks were files used to be, but have been deleted? Or will it still copy all sectors with some sort of data on them? i.e. should I still be able to find any deleted files on the clonezilla image or not?

(related questions: How else can I create a full disk image for deleted file recovery? Can I use Sleuthkit/Foremost directly on a physical disk?)

2
  • 2
    I think the best way to make an as-is image would be using dd.
    – slhck
    Apr 22, 2013 at 10:27
  • If I use dd, any specific blocksize and other stuff I should specify? Or can I just run dd if=/dev/sda of=/extHD/sda.img? I would like to reduce the time as much as possible, since the disk is about 220GB big.
    – KIAaze
    Apr 22, 2013 at 10:35

1 Answer 1

3

Nope. Clonezilla won't save tge blocks that used to exist. It will backup all the present data only.

1
  • Ok, a whole evening creating the image wasted then. :( Thanks.
    – KIAaze
    Apr 22, 2013 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .