Data Recovery/Forensics

[Kain]

--4Ckj6UjgE2iN1+kY
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Oct 30, 2003 at 07:02:37AM -0600, Peter Amisano wrote:
> When imaging a piece of media using DD, will the subject device be written
> to in any way?  Are there other methods of imaging a device other than DD?
Well, the dd itself will not trigger a write to the media you are imaging f=
rom,
but if you're pulling from any sort of modern hard disk, the drive in quest=
ion
could theoretically decide to do a block or sector remapping which does cha=
nge
the raw data on the platters.  Also, if your drive has SMART (practically
everything in the last 5-6 years?), data such as power-on time and power-cy=
cle
count can be logged.

But no, dd will not alter what the host controller sees as the drive's data.
--=20
Bryon Roche
Professional {Developer,Guru,Mad Scientist}
<kain at kain.org>
PGP Key Fingerprint: FE0D EC23 6464 726A CD54  48D3 04AD 86FE 6878 ABD5
Success, recognition, and conformity are the bywords of the modern world wh=
ere
everyone seems to crave the anesthetizing security of being identified with=
 the
majority...Human salvation lies in the hands of the creatively maladjusted.
  -- Martin Luther King, Jr.

--4Ckj6UjgE2iN1+kY
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/oRwnBK2G/mh4q9URAvAMAJwIenhb9SAbaF6ceziOMiKUSpzTRQCggOLb
UM2Yliy4frzKgfS/Ow2w0ZA=
=0NkB
-----END PGP SIGNATURE-----

--4Ckj6UjgE2iN1+kY--