Need to know how to copy a drive

Rifle24 · 10-06-2006, 05:47 PM

I need help, please excuse my stupidity. I need to copy a hard drive, but I want to copy it exactly, I mean I need the low level recoverble data that may or may not exist. This would be a simular need as a "chain of evidence" siyuation. Can this be done with software?

crazijoe · 10-06-2006, 06:13 PM

Hello and welcome to TSF.

Is this data that was deleted?

**Cellus** · 10-06-2006, 08:10 PM

First thing is first, are you trying to collect evidence upholdable in court from the drive - as in computer forensics? Please tell us exactly why you want a bit stream backup (that's what you're asking for, also known as a mirror image backup).

If it is delving into the realm of legally-upholdable evidence and computer forensics it is vital you say so before even touching the machine. The procedure for copying data from a machine for legal purposes is extremely strict and uncompromising. It's important to know beforehand. Also note if you are serious in pursuing this in a court of law. If you're doing it to, as a shameless example, to see if someone had deleted a copy of your secret family recipe for guacamole, then ignore the following below.

If it is a serious matter that you intend to pursue in a court of law, please do the following:

1) Do not shutdown or turn off the machine. Shutting down a machine changes dozens of files, including clearing your page file among many other things.

2) Contact a Data Security firm in your area immediately and see if they have experience and are certified in Computer Forensics. If they are, tell them you need a Bit Stream Backup of a hard drive for evidence and follow their instructions. This will cost money, but these people know exactly what to do and can make an evidence-grade copy of your data that can be used in court, can maintain the proper chain of custody, and so forth.

If it isn't serious, then you can find software bit stream backup programs on the internet (make sure they can block writes) or even a hardware appliance with a write blocker that does bit stream backups and do it yourself.

Rifle24 · 10-09-2006, 10:24 AM

I want to back up a USB stand alone harddrive for my personal protection before I turn it over for a investigation of others. This would be a "CYA" for me really. I have nothing to do with this, but was unlucky enough to stumble on a drive that may or may not be important.

**linderman** · 10-09-2006, 04:00 PM

well if this drive is not going to be worked on by the CIA or FBI then two seperate runs of Dban boot & nuke will do the trick I ran boot & nuke on a drive once then tried a recovery program for deleted data >>>> if found nothing >>>> not even gibersh

but if you are in a situtation where your hard drive is going to be "looked" at for serious criminal investagation and the investagating body wants to really spend the money then who knows ?????

Rifle24 · 10-13-2006, 04:50 PM

Thanks for all the info. I was just making sure that I was covered in a "Just in case" scenario. I just turned it over. I just happened to stumble accross a drive that was unknown to exist. It did. I hope it helps others, it has little if anything to do with me. I just did not want to trust who I was turning it over to. You know, some of the things that should be there all of a sudden are not.

Thanks again.

thepit56 · 10-14-2006, 05:43 AM

i agree with everone else.

10-06-2006, 05:47 PM	#1 (permalink)
Rifle24 Registered User Join Date: Oct 2006 Posts: 3 OS: Win XP	Need to know how to copy a drive I need help, please excuse my stupidity. I need to copy a hard drive, but I want to copy it exactly, I mean I need the low level recoverble data that may or may not exist. This would be a simular need as a "chain of evidence" siyuation. Can this be done with software?

10-06-2006, 06:13 PM	#2 (permalink)
crazijoe Registered User Join Date: Oct 2004 Location: Omaha, The Center of the Universe Posts: 7,632 OS: WinXP, Win2K3 My System	Hello and welcome to TSF. Is this data that was deleted? __________________ Microsoft MCSA + Messaging, MVP, A+, Network+ http://i16.photobucket.com/albums/b3...other/Help.jpg Do you want a real Republican? HDD diagnostic tools / HDD data recovery software

10-06-2006, 08:10 PM	#3 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,664 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	First thing is first, are you trying to collect evidence upholdable in court from the drive - as in computer forensics? Please tell us exactly why you want a bit stream backup (that's what you're asking for, also known as a mirror image backup). If it is delving into the realm of legally-upholdable evidence and computer forensics it is vital you say so before even touching the machine. The procedure for copying data from a machine for legal purposes is extremely strict and uncompromising. It's important to know beforehand. Also note if you are serious in pursuing this in a court of law. If you're doing it to, as a shameless example, to see if someone had deleted a copy of your secret family recipe for guacamole, then ignore the following below. If it is a serious matter that you intend to pursue in a court of law, please do the following: 1) Do not shutdown or turn off the machine. Shutting down a machine changes dozens of files, including clearing your page file among many other things. 2) Contact a Data Security firm in your area immediately and see if they have experience and are certified in Computer Forensics. If they are, tell them you need a Bit Stream Backup of a hard drive for evidence and follow their instructions. This will cost money, but these people know exactly what to do and can make an evidence-grade copy of your data that can be used in court, can maintain the proper chain of custody, and so forth. If it isn't serious, then you can find software bit stream backup programs on the internet (make sure they can block writes) or even a hardware appliance with a write blocker that does bit stream backups and do it yourself. __________________ TSF Networking Team HijackThis 5 Step Process Donate! Last edited by Cellus; 10-06-2006 at 08:27 PM.

10-09-2006, 10:24 AM	#4 (permalink)
Rifle24 Registered User Join Date: Oct 2006 Posts: 3 OS: Win XP	Not exactly a evidence situation. I want to back up a USB stand alone harddrive for my personal protection before I turn it over for a investigation of others. This would be a "CYA" for me really. I have nothing to do with this, but was unlucky enough to stumble on a drive that may or may not be important.

10-09-2006, 04:00 PM	#5 (permalink)
linderman Moderator, Hardware Team Join Date: May 2005 Posts: 19,370 OS: win 2000 pro / Win XP pro My System	well if this drive is not going to be worked on by the CIA or FBI then two seperate runs of Dban boot & nuke will do the trick I ran boot & nuke on a drive once then tried a recovery program for deleted data >>>> if found nothing >>>> not even gibersh but if you are in a situtation where your hard drive is going to be "looked" at for serious criminal investagation and the investagating body wants to really spend the money then who knows ????? __________________ Even a Broken Clock is Right Twice a Day ! Power Supply Selection LEARN TO BACK-UP YOUR DATA FREE & EASY YouTube - Runtime Software DriveImage XML tutorial

10-13-2006, 04:50 PM	#6 (permalink)
Rifle24 Registered User Join Date: Oct 2006 Posts: 3 OS: Win XP	Back up hard drive Thanks for all the info. I was just making sure that I was covered in a "Just in case" scenario. I just turned it over. I just happened to stumble accross a drive that was unknown to exist. It did. I hope it helps others, it has little if anything to do with me. I just did not want to trust who I was turning it over to. You know, some of the things that should be there all of a sudden are not. Thanks again.

10-14-2006, 05:43 AM	#7 (permalink)
thepit56 Registered User Join Date: May 2006 Posts: 272 OS: windows XP Professional Edition sp2	hey i agree with everone else.