lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon Sep 12 16:09:14 2005 From: pauls at utdallas.edu (Paul Schmehl) Subject: Forensic help? --On Monday, September 12, 2005 10:11:24 -0400 Red Leg <redleg18@...il.com> wrote: > > Does dcfldd allow me to mirror the disk in such a manner as to include > deleted files? I can not swap drives. I need to obtain an image with > which I can "undelete" files that were conventionally erased. > > Will dcfldd provide such an image? > Yes. dcfldd is a bit for bit copy of the drive. All bits, including deleted files, etc., are included. Paul Schmehl (pauls@...allas.edu) Adjunct Information Security Officer University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/ir/security/
Powered by blists - more mailing lists