Toolkit

Story: Expert undermines hacking suspect's defence

• 
• 

Did the examiners:

 - mount the original disk on a *hardware* disk duplicating device, with read-only capability

 - temporarily disable all error correction on the original disk prior to taking a duplicate image TO A ZERO-MEDIA-DEFECT DUPLICATE of the original disk (make, model, factory & firmware revision)

 - duplicate the internal sector-sparing tables from the original disk

 - then manually reconstruct the same sector-sparing tables on the zero-defect duplicate disk

???...

I can't think of any other way to identically duplicate the original disk, if one is going to convict over arguments of contiguous and/or non-contiguous disk blocks/sectors.

An image recorded to CDROM or DVD could not possibly be an exact sector-level duplicate of the original disk, unless the original disk, itself was also a CDROM or DVD.

• 
• 

• 
• 
• 

Full Talkback thread