Re: [Full-disclosure] Forensic help?

[Red Leg <redleg18@xxxxxxxxx>]

On 9/11/05 6:33 PM, "Red Leg" <redleg18@xxxxxxxxx> wrote:

> Hi all.
> 
> I was wondering if anyone knows of a program/system that I can purchase, as
> a private individual, that will allow me to
> 
> 1) mirror a hard drive on location and
> 
> 2) take that mirror and restore it to another drive. And
> 
> 3) Find any CONVENTIONALLY erased files?
> 
>  -- This would be either a Windows NTFS or FAT32 drive.


Wow!

Thanks all. I really appreciate the education!

I wish that I could keep the target drive, and change it out. However, this
is a Freedom of Information Act issue. I don't think they'll let me keep the
original/target.


I knew about Drive Image, but I didn't know it or Symantec Ghost would be
able to get the erased data (as in using the "Delete Key" or right click
delete).

Thanks!
Redleg18


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/