RE: problems cloning a hard drive with dcfldd

Farmerdude,

Here are the results of the commands you suggested:

blkid:
/dev/sda1: UUID="D08405CF8405B94C" TYPE="ntfs"
/dev/sda2: UUID="423B-2BDF" TYPE="vfat"

fdisk:


Disk /dev/sda: 40.0 GB, 40007761920 bytes
255 heads, 63 sectors/track, 4864 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x4b36bdea

Device Boot Start End Blocks Id System
/dev/sda1 * 463 4863 35351032+ 7 HPFS/NTFS
/dev/sda2 1 462 3710983+ b W95 FAT32

Partition table entries are not in disk order

While I don't have a usb or firewire drive I can use to clone to directly, I do have an external harddrive enclosure for a laptop drive, so I will be pulling the drive from the laptop and connecting it to my forensics workstation using the enclosure.

I will try cloning the entire drive instead of just the ntfs partition also..

Thanks for the tips.

-----Original Message-----
From: farmerdude [mailto:subscribe@xxxxxxxxxxxxxx]
Sent: Friday, August 08, 2008 6:40 PM
To: DON.RAIKES@xxxxxxxxxx
Cc: focus-linux
Subject: Re: problems cloning a hard drive with dcfldd


Don,

Can you provide the output of these commands issued from the laptop
system;

fdisk -l


blkid /dev/sda*



Instead of blowing across the network, are you able to attach a firewire
or USB hard drive to the laptop and blow your acquisition file via one
of those ports locally?


Also, based on your dcfldd command, you know that you are acquiring only
the first partition on the physical device, /dev/sda, yes?

If you want the physical device, remove the number from your command.
If you want only the partition continue on with your command then!

Cheers!

farmerdude

http://www.forensicbootcd.com

http://www.onlineforensictraining.com

Relevant Pages

  • Re: New HDD Installation
    ... DISKPART> list disk ... DISKPART> select partition 1 ... You can do the same thing starting with the "list volume" instead of the "list disk" command, then selecting volumes to gain focus. ... At this point I haste to point out that this is mostly for educational purposes and for you to gain an inner working knowledge of disks and partitions and how Windows works with them. ...
    (microsoft.public.windowsxp.general)
  • Re: [opensuse] raid question
    ... i partition here the new disk (maybe with fdisk, ... The number of cylinders for this disk is set to 4865. ... Command: m ...
    (SuSE)
  • Re: Error 16: Inconsistent filesystem structure
    ... My preference would be a /home partition to protect my data ... Here is a copy of the output of fdisk -l and fdisk /dev/sdb with x then ... I used the Negus Fedora 7 book's Live cd. ... Disk /dev/sdb: 200.0 GB, 200049647616 bytes ...
    (Fedora)
  • Re: Debian in a VMware VM and LVM
    ... First I had a look at the current disk layout using fdisk -l ... Partition 1 does not end on cylinder boundary. ...
    (Debian-User)
  • Re: Installation of hard drive - SOLVED
    ... Wll be also good for you if you learn how to use the number notation for chmod command. ... > Then try to mount the partition using the command line: ... >>> install ... >>> hard disk. ...
    (Debian-User)