Two e01 forensic image on one larger drive !


Thomas30

New Member
Nov 21, 2016
12
0
#1
Hello,
Is it good to acquire e01 forensics binary copy from two discs on one larger disc ? From example I have two discs - one 120GB, second 320GB, and I do binary copy of them on one larger disc from example 1TB.
Except from fact that when I physically damage that 1TB disc I lose both of binary copies of that (120, 320) discs.
What are others disadvantages of doing this ?
 
Dec 31, 2006
3,405
0
#2
There is nothing wrong with imaging multiple disks to a single disk. Not much different than imaging multiple disks to a RAID.

Hmmm. Disadvantages. If consent or legal authority was revoked for one of the original items you imaged you would have to show you properly deleted it. There is always the chance of a hardware failure and you lose both image files before making your backup copy. I am sure there are other disaster scenarios as well.
 

SgtJackie

New Member
Nov 30, 2015
58
0
#5
There's no reason you can't do that if you want to, just make sure that a) there is enough room on the drive for both - leave some overhead, b) it's been forensically wiped before re-use c) you have hashed both the originals and the copies to make sure they are identical.
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu