Difference between pages "Educational Resources for Teaching Computer Forensics" and "AIR"
From Forensics Wiki
(Difference between pages)
m |
|||
| Line 1: | Line 1: | ||
| − | + | {{Infobox_Software | | |
| + | name = AIR | | ||
| + | maintainer = [[Steve Gibson]] | ||
| + | Modding [[Nanni Bassetti]]| | ||
| + | os = {{Cross-platform}} | | ||
| + | genre = {{Disk imaging}} | | ||
| + | license = {{GPL}} | | ||
| + | website = [http://air-imager.sourceforge.net/ air-imager.sourceforge.net] | | ||
| + | }} | ||
| − | + | The '''Automated Image and Restore''' or '''AIR''' is a GUI front-end to [[dd]] and [[dc3dd]] designed for easily creating forensic bit images. | |
| − | * [http:// | + | |
| + | Features: | ||
| + | # auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives | ||
| + | # choice of using either dd or dcfldd | ||
| + | # image verification between source and copy via MD5 or SHA1/256/384/512 | ||
| + | # image compression/decompression via gzip/bzip2 | ||
| + | # image over a TCP/IP network via netcat/cryptcat | ||
| + | # supports SCSI tape drives | ||
| + | # wiping (zeroing) drives or partitions | ||
| + | # splitting images into multiple segments | ||
| + | # detailed logging with date/times and complete command-line used | ||
| + | |||
| + | == External Links == | ||
| + | |||
| + | * [http://air-imager.sourceforge.net/ Official website] | ||
Latest revision as of 13:10, 28 March 2010
| AIR | |
|---|---|
| Maintainer: | Steve Gibson
Modding Nanni Bassetti |
| OS: | Cross-platform |
| Genre: | Disk imaging |
| License: | GPL |
| Website: | air-imager.sourceforge.net |
The Automated Image and Restore or AIR is a GUI front-end to dd and dc3dd designed for easily creating forensic bit images.
Features:
- auto-detection of IDE and SCSI drives, CD-ROMs, and tape drives
- choice of using either dd or dcfldd
- image verification between source and copy via MD5 or SHA1/256/384/512
- image compression/decompression via gzip/bzip2
- image over a TCP/IP network via netcat/cryptcat
- supports SCSI tape drives
- wiping (zeroing) drives or partitions
- splitting images into multiple segments
- detailed logging with date/times and complete command-line used