RE: Linux, dd, and image file

From: Altheide, Cory B. <AltheideC(at)nv.doe.gov>
Date: Fri Apr 04 2003 - 11:55:46 EST

> -----Original Message-----
> From: Stephen Samuel [mailto:samuel@bcgreen.com]
> Sent: Thursday, April 03, 2003 10:30 AM
> To: forensics@securityfocus.com; jcreyes@007mundo.com
> Subject: Re: Linux, dd, and image file
>
>
> One problem with imaging each partition is that you may miss

A knowledgable investigator might image the inter-partition spaces (and pre-/post-partition spaces), as well as the partitions. :)

Cory Altheide
Computer Forensics Specialist
NCI Information Systems, Inc.
NNSA Cyber Forensics Center
altheidec@nv.doe.gov

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Tue Apr 8 19:14:56 2003