Difference between pages "Disk image" and "User talk:ACME Portable Computers"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
m (Welcome!)
 
Line 1: Line 1:
A disk image is a full disk copy of the data making up the partition table, file allocation tables and data partitions without regard for operating system.
+
'''Welcome to ''Forensics Wiki''!'''
 
+
We hope you will contribute much and well.
A disk image should be made prior to performing any forensic analysis of the disk.  Creating a disk image is important in forensics for several reasons:
+
You will probably want to read the [[Help:Contents|help pages]].
 
+
Again, welcome and have fun! [[User:Simsong|Simsong]] ([[User talk:Simsong|talk]]) 21:51, 15 May 2013 (CDT)
1. Ensure that disk information is not inadvertantly changed during analysis. 
+
2. By performing an original disk image and storing the original disk, it is possible to reproduce forensic test results with an exact reproduction of analysis methods on the original evidence.
+
3. Disk imaging will capture information invisible to the operating system in use *E.g. hidden partitions, ext3 partitions on a Windows machine, etc.
+
 
+
Software
+
Popular software used to create disk images includes Norton Ghost
+

Latest revision as of 22:51, 15 May 2013

Welcome to Forensics Wiki! We hope you will contribute much and well. You will probably want to read the help pages. Again, welcome and have fun! Simsong (talk) 21:51, 15 May 2013 (CDT)