Date sent: Wed, 20 Mar 2002 01:41:30 -0500
From: rsgilmoreblclinks.net
To: "forensicssecurityfocus.com" <forensicssecurityfocus.com>
Subject: Re: Encase and data recovery

I'm afaid not. "Copy-II-PC" ran as a DOS application. I'm suggesting
a totally OS-free system using a few kB of dedicated machine code.

The reason is that even a DOS environment could be contaiminated by
doing other things with the platform. A one-job machine stays clean
much more *demonstrably*. Remember that forensics is not just about
being right- it's about being right *and convincing*, and your most
important audience (the jury) normally hasn't a clue what you're
talking about technically.

I don't know them myself, but another correspondent has mailed me
with two potential tools
"the Solo <http://www.ics-iq.com/html/forensics.html>
and Solitaire <http://www.logicube.com/store/solitaire_turbo.html>
disk duplicators."

Thanks to Buck at CSC.COM for this.

Mike

>
> Hmmm... a HD version of the old DOS floppy-copy utility
> "Copy-II-PC" ???
>
>
> "Michael D. Barwise, BSc, IEng, MIIE, MBCS" wrote:
>
> > My ideal disk copier would be a very basic PC... with a truly blank
> > target disk and a spare port, running nothing except a custom-written
> > native application which does nothing except read literal sectors from
> > one hard disk to another (no OS).
> ---
> [This E-mail was scanned for viruses by http://www.intouchmi.com]
>
>
> -----------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]