Toolkit

Story: Expert undermines hacking suspect's defence

• 
• 

A true sector-level disk image, with no "dead-space" skipping and no "image compression" should almost preserve the exact sector-level state of the original drive, as long as the orignal drive was properly mounted for forensic analysis (absolutely no external write capabilities).

But there are possible, and potentially serious exceptions...

I do not know how hardware-level bad sector sparing would be copied and/or missed by COTS sector-level disk imaging tools.

I believe most COTS tools simply skip already mapped "bad sectors" and also slip-stream in any on-the-fly "spare sectors," swapped in (by hardware), for bad/failing sectors .

• 
• 

• 
• 
• 

Full Talkback thread