I you work with a live system then use FTK Imager (lite) from a USB-drive.
If the system is off I always use DEFT Linux or the new DEFT-lite from a USB-drive to start the system I'm investigating. This Linux distro doesn't mount the system-drive(s) RW so it's forensically sound.
When the system is started with Deft you can use the Linux imaging tool GuyMager to image the HDD('s) or if you have to be in contact with your inner-nerd use DD from the terminal
You can find DEFT here: http :// www . deftlinux . net/
All times are GMT + 10 Hours Goto page Previous1, 2
Page 2 of 2
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum