On 06/06/10 06:19, Andrea Conti wrote:
>> 1. boot up knoppix 2. create a partition: mkdir /work 3. mount
>> /work to the root partition: mount /dev/sdc /work 4. cd
>> /work/usr/bin 5. run dcfldd: ./dcfldd
>
> This is fine, provided that
>
> 1- if the root partition is [part of] what you're copying, you
> *must* mount it read-only (mount -o ro /dev/sdc /work)
Not from my experience; I simply mount, exec, and go - Works fine, be it
a partition or a disk copy (though it seems likely that the last access
dates would be changed if forensics is an issue).
>
> 2- the dcfldd executable is linked statically. If it uses dynamic
> linking, your "live" system -- knoppix in this case -- must have
> exactly the same library versions (especially glibc) as the gentoo
> system.
Good point. I've been using a contemporary Gentoo live disk and the
libraries happen to be compatible.................
# ldd /usr/bin/dcfldd
linux-vdso.so.1 => (0x00006cdd998b6000)
libc.so.6 => /lib/libc.so.6 (0x00006cdd99341000)
/lib64/ld-linux-x86-64.so.2 (0x00006cdd9969b000)
Based on this thread, I'll be running my backups from a
statically-linked copy of dcfldd on a "jumpdisk" (backup copy on the
boot sector).
- Any advice on the dd "blocksize" parameter?
