Difference between revisions of "AIR"
From Forensics Wiki
(Added infobox, cleaned up)
|Line 8:||Line 8:|
The '''Automated Image and Restore''' or '''AIR''' is a GUI front-end to [[dd]] and [[
The '''Automated Image and Restore''' or '''AIR''' is a GUI front-end to [[dd]] and [] designed for easily creating forensic bit images.
Revision as of 12:05, 28 March 2010
- auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives
- choice of using either dd or dcfldd
- image verification between source and copy via MD5 or SHA1/256/384/512
- image compression/decompression via gzip/bzip2
- image over a TCP/IP network via netcat/cryptcat
- supports SCSI tape drives
- wiping (zeroing) drives or partitions
- splitting images into multiple segments
- detailed logging with date/times and complete command-line used