On 06/06/10 06:19, Andrea Conti wrote: >> 1. boot up knoppix 2. create a partition: mkdir /work 3. mount >> /work to the root partition: mount /dev/sdc /work 4. cd >> /work/usr/bin 5. run dcfldd: ./dcfldd > > This is fine, provided that > > 1- if the root partition is [part of] what you're copying, you > *must* mount it read-only (mount -o ro /dev/sdc /work)
Not from my experience; I simply mount, exec, and go - Works fine, be it a partition or a disk copy (though it seems likely that the last access dates would be changed if forensics is an issue). > > 2- the dcfldd executable is linked statically. If it uses dynamic > linking, your "live" system -- knoppix in this case -- must have > exactly the same library versions (especially glibc) as the gentoo > system. Good point. I've been using a contemporary Gentoo live disk and the libraries happen to be compatible................. # ldd /usr/bin/dcfldd linux-vdso.so.1 => (0x00006cdd998b6000) libc.so.6 => /lib/libc.so.6 (0x00006cdd99341000) /lib64/ld-linux-x86-64.so.2 (0x00006cdd9969b000) Based on this thread, I'll be running my backups from a statically-linked copy of dcfldd on a "jumpdisk" (backup copy on the boot sector). - Any advice on the dd "blocksize" parameter?