Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] Forensic help?
From: Paul Robertson (compuwargmail.com)
Date: Fri Sep 16 2005 - 13:05:25 CDT
On 9/12/05, Nick FitzGerald <nickvirus-l.demon.co.uk> wrote:
> Anyway, much as I am an _only very occasional_ user of Ghost, I don't
> think I've ever used it NOT to make a sector-level, or raw disk image,
> style drive copy. However, as I last used it so long ago, I decided to
> check I was not mis-remembering -- two seconds at Google turned up this
> URL discussing "...the Ghost switches to use for forensic imaging or
> for creating raw images (sector copies)..." (URL may wrap):
While you *can* use Ghost to get a complete image, the switches change
from version to version and it's really a PITA to test what does what
when. Most folks I know if the field have decided there's too much
room for error with Ghost. Also, it means more to document, which is
bad for the lazy ;).
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/