Congratulations Alexander, You hit the nail on the head. I am imaging
drives for computer forensics purposes, and am interested in finding faster
easier ways to obtain these images. Images made with dd, when taken from a
read-only mounted drive, are superb evidence. The real fun is getting the
naughty bits off the drive images.....
----- Original Message -----
From: "Alexandre Oliva" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Cc: "Dave Hecht" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>
Sent: Thursday, April 05, 2001 8:21 PM
Subject: Re: Sector Level Backups
> On Apr 5, 2001, "John R. Jackson" <[EMAIL PROTECTED]> wrote:
>
> > But I'm curious why you would want to. If you're backing up a disk that
> > contains file systems, the result will be almost useless unless you've
> > unmounted all the file systems while the backup is running.
>
> One of the reasons I could think of to do this is to preserve
> information of deleted files that might still be there, that could
> then be used for some investigation or as evidence in trial. You'd
> probably not want to do this on a regular basis, though, so I'd
> probably do this kind of operation as a one-shot thing, without
> Amanda.
>
> --
> Alexandre Oliva Enjoy Guarana', see http://www.ic.unicamp.br/~oliva/
> Red Hat GCC Developer aoliva@{cygnus.com, redhat.com}
> CS PhD student at IC-Unicamp oliva@{lsd.ic.unicamp.br, gnu.org}
> Free Software Evangelist *Please* write to mailing lists, not to me
>
