Difference between pages "SAFE Block XP" and "Talk:Linux Logical Volume Manager (LVM)"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(Created page with '{{Infobox_Software | name = SAFE Block XP | maintainer = ForensicSoft | os = {{Windows}} | genre = {{Write Blockers}} | license = {{Commercial}} | website = [http…')
 
(Created page with "Should we change :To make the volume group known to the system :vgexport $VOLUMEGROUP to :To make the volume group known to the system :vgimport $VOLUMEGROUP ? vgexport ma...")
 
Line 1: Line 1:
{{Infobox_Software |
+
Should we change
  name = SAFE Block XP |
+
  maintainer = [[ForensicSoft]] |
+
  os = {{Windows}} |
+
  genre = {{Write Blockers}} |
+
  license = {{Commercial}} |
+
  website = [http://www.forensicsoft.com/catalog/product.php http://www.forensicsoft.com/catalog/product.php] |
+
}}
+
  
The '''System Acquisition Forensic Environment (SAFE) Block XP''' software is a software-based write blocker designed for the Windows XP 32 and 64 bit operating system. Because it is software based it allows for disk imaging speeds that are significantly faster than imaging in Windows using commercially available hardware-based write blockers. It also allows you to write block as many devices as are connected to the computer. It is application independent and works with all forensic acquisition and analysis software that works on Windows. In order to ensure that you are working forensically sound environment '''SAFE Block XP''' provides automatic write blocking of all directly attached media, including IDE (PATA & SATA), SCSI, FC, SAS, USB, and IEEE1394.
+
:To make the volume group known to the system
 +
:vgexport $VOLUMEGROUP
  
'''SAFE Block XP''' identifies and provides access to Host Protected Areas (HPAs) and Device Configuration Overlay (DCOs) on IDE (PATA and SATA) disks, connected directly via PATA or SATA controllers. HPAs are temporarily removed and make no permanent modification to the disk configuration, using volatile HPA commands. Since a DCO cannot be removed temporarily, SAFE Block XP preserves all DCO information, allowing safe removal of the DCO or HPA/DCO combination, then upon completion of the acquisition, replacement of the DCO or HPA/DCO combination back to its original state.
+
to
  
== Notes ==
+
:To make the volume group known to the system
 +
:vgimport $VOLUMEGROUP
 +
?
  
* '''SAFE Block XP''' has passed all of NIST's Mandatory and Optional Test Assertions, including not allowing a protected drive to be changed, not preventing obtaining any information from or about any drive and not preventing any operations to a drive that is not protected.
+
vgexport makes volume groups ''unknown'' to the system, vgimport makes exported volumes ''known'' to the system. See also [http://www.tldp.org/HOWTO/LVM-HOWTO/recipemovevgtonewsys.html this]. You should also remember, that both vgexport/vgimport alter the data on the physical device. I also added "loop" option to the mount command example, since "-o ro" may alter the data in the file system (replay the journal, etc) [[User:.FUF|.FUF]] ([[User talk:.FUF|talk]]) 10:19, 7 May 2014 (CDT)

Latest revision as of 10:19, 7 May 2014

Should we change

To make the volume group known to the system
vgexport $VOLUMEGROUP

to

To make the volume group known to the system
vgimport $VOLUMEGROUP

?

vgexport makes volume groups unknown to the system, vgimport makes exported volumes known to the system. See also this. You should also remember, that both vgexport/vgimport alter the data on the physical device. I also added "loop" option to the mount command example, since "-o ro" may alter the data in the file system (replay the journal, etc) .FUF (talk) 10:19, 7 May 2014 (CDT)