Here's a Handy Tool for Disk Imaging

[Wayne Davis]

Jon M. Hanson wrote:
> dd (and all of the variants mentioned here) makes a sector-by-sector 
> copy of the physical disk. It doesn't care what filesystem is used 
> because it isn't reading at the filesystem level. It's reading the 
> actual bits that make up the filesystem structures and the files 
> themselves. So if you properly use dd (capture the correct partitions) 
> then you will get an image that will allow you to do a "bare metal" 
> recovery without having to reinstall the operating system.
>
> Wayne Davis wrote:
>> In the event of a catastrophic drive failure, Will this recover a system 
>> WITHOUT re-installing the OS first?  I didnot see a mechanism for doing 
>> that.
>>
>>   Arconis uses a boot cd that enables USB, network shares and uses image 
>> files Ive created on a 80 gig USB drive formatted  NTFS as well as other 
>> images on shared NTFS drives.
>>
>>
>> Erich Newell wrote:
>>   
>>> I just popped in and have seen a ton of comments regarding proper 
>>> imaging of a hard drive, and thought I'd throw in my two cents.
>>>
>>> One of my favorite tools is dcfldd ( 
>>> http://www.forensicswiki.org/wiki/Dcfldd and 
>>> http://www.sourceforge.net/projects/dcfldd/). It is a forensic version 
>>> of dd, that can be used over a network. It essentially does the same 
>>> things that many have been describing, but in a much cleaner interface.
>>>
>>> A snippet from the wiki:
>>>
>>> -------- snip -------
>>>
>>> *dcfldd* is an enhanced version of dd 
>>> <http://www.forensicswiki.org/wiki/Dd>. It has some useful features 
>>> for forensic investigators 
>>> <http://www.forensicswiki.org/index.php?title=Investigator&action=edit>:
>>>
>>>     * On-the-fly hashing <http://www.forensicswiki.org/wiki/Hash> of
>>>       the transmitted data.
>>>     * Progress bar of how much data has already been sent.
>>>     * Wiping of disks with known patterns.
>>>     * Verification that the image is identical to the original drive,
>>>       bit-for-bit.
>>>     * Simultaneous output to more than one file/disk is possible.
>>>     * The output can be splitted into multiple files.
>>>     * Logs and data can be piped into external applications.
>>>
>>> The program only produces raw image files 
>>> <http://www.forensicswiki.org/wiki/Raw_image_file>.
>>>
>>> -------- end snip -------
>>>
>>> I thought some may find this useful.
>>>
>>> -- 
>>> "A man is defined by the questions that he asks; and the way he goes 
>>> about finding the answers to those questions is the way he goes 
>>> through life."
>>> ------------------------------------------------------------------------
>>>
>>> ---------------------------------------------------
>>> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>>> To subscribe, unsubscribe, or to change  you mail settings:
>>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>>     
>>
>> ---------------------------------------------------
>> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
>> To subscribe, unsubscribe, or to change  you mail settings:
>> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>>   
>
>
> -- 
> Jon M. Hanson (N7ZVJ)
> Homepage:  http://the-hansons-az.net
> Weblog:    http://the-hansons-az.net/wordpress
> Jabber IM: jon at the-hansons-az.net
> ------------------------------------------------------------------------
>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss at lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change  you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
Forgive my ignorance, I am new to linux.   I still don't see how that is 
possible.  Assuming I have made a CD or DVD of this image, I would still 
need a application to use it.  Assuming  the drive had failed and I put 
a a new one in.  I would need to load a app that would transfer the 
image file to the new drive.... right?