I just popped in and have seen a ton of comments regarding proper imaging of a hard drive, and thought I&#39;d throw in my two cents.<br><br>One of my favorite tools is dcfldd (<a href="http://www.forensicswiki.org/wiki/Dcfldd">
http://www.forensicswiki.org/wiki/Dcfldd</a> and <a href="http://www.sourceforge.net/projects/dcfldd/">http://www.sourceforge.net/projects/dcfldd/</a>). It is a forensic version of dd, that can be used over a network. It essentially does the same things that many have been describing, but in a much cleaner interface.
<br><br>A snippet from the wiki:<br><br>-------- snip -------<br><p><b>dcfldd</b> is an enhanced version of <a href="http://www.forensicswiki.org/wiki/Dd" title="Dd">dd</a>. It has some useful features for forensic <a href="http://www.forensicswiki.org/index.php?title=Investigator&amp;action=edit" class="new" title="Investigator">
investigators</a>:
</p>
<ul><li> On-the-fly <a href="http://www.forensicswiki.org/wiki/Hash" title="Hash">hashing</a> of the transmitted data.
</li><li> Progress bar of how much data has already been sent.
</li><li> Wiping of disks with known patterns.
</li><li> Verification that the image is identical to the original drive, bit-for-bit.
</li><li> Simultaneous output to more than one file/disk is possible.
</li><li> The output can be splitted into multiple files.
</li><li> Logs and data can be piped into external applications.
</li></ul>
<p>The program only produces <a href="http://www.forensicswiki.org/wiki/Raw_image_file" title="Raw image file">raw image files</a>. <br></p>-------- end snip -------<br><br>I thought some may find this useful.<br><br>-- 
<br>&quot;A man is defined by the questions that he asks; and the way he goes about finding the answers to those questions is the way he goes through life.&quot;<br>