The best that can be achieved is via 'dd'. however it is actually impossible to get _real_ raw disk access due to the disk IO controllers. As far as I know, all disk IO controllers have automatic data correction etc and so do hard disks. An accurate copy of the surface of the disk cannot be gained by this method.
Has anyone any ideas on whether it's possible to bypass the automatic checks performed by the IO controllers? Colin Solution City Ltd http://www.solution-city.com -----Original Message----- From: viv [mailto:[EMAIL PROTECTED] Sent: 07 January 2003 21:08 To: DebianSecurity Subject: raw disk access Hi. As a Debian user, i am posting to this list first in the hopes that what i am looking for can be found as a Debian package. i am looking for forensics tools that can be used in computer crime investigations, and am particularly interesting in a tool that provides raw drive (hard, floppy, CD, DVD, etc.) access in order to create complete and accurate drive images. If such a tool does not exist within Debian, is anyone aware of any application (GPLed, please) that does? Failing that, i am willing to write my own tool, if necessary, and would appreciate any pointers to good reference material (raw drive access and how to work with the images created). If it helps, i am running with the latest 'unstable' packages. Many thanks. -- viv <[EMAIL PROTECTED]>
