Image option from ProDiscover Basic software package.
Prodiscover basic and image files how to#
In this section, you learn how to make an image of a larger drive and apply the Split function in ProDiscover Basic to create segmented files of 650 MB each that can be archived to CDs.īefore acquiring data directly from a suspect drive with ProDiscover Basic, always use a hardware write-blocker device. Topics like operating systems internals, file systems, computer organisation, data representation. Because USB drives are typically small, a single image file can be acquired with no need to segment it. ProDiscover automates many acquisition functions, unlike current Linux tools. In Chapter 2, you learned how to acquire an image of a USB drive. Exercise 3 - Capturing an Image with ProDiscover Basic Exercise 2 - Acquiring Data with dd in Linuxįollow these steps to make an image of an NTFS disk on a FAT32 disk by using the dd command. For information on Mac OS X file systems and acquisitions, see Chapter 7. You can download this driver from, where you can also find information about NTFS and instructions for installing the driver. Linux kernel version 2.6.17.7 and earlier can format and read only the FAT file system, although an NTFS driver, NTFS-3G, is available that allows Linux to mount and write data only to NTFS partitions. Current Linux distributions can create Microsoft File Allocation Table (FAT) and New Technology File System (NTFS) partition tables. The Linux OS has many tools you can use to modify non-Linux file systems. Using ProDiscover’s Proprietary Acquisition FormatĮxercise 1 - Preparing a Target Drive for Acquisition in Linux.Capturing an Image with ProDiscover Basic.Preparing a Target Drive for Acquisition in Linux.The Data Acquisition module provides you with the instructions and devices to develop your hands on skills in the following topics: