MrMille
New Member
- Reaction score
- 0
- Location
- Dublin, Ireland
ok I see what you mean, I would just image the drive sector for sector, and work on the image using any recovery software, most imaging apps allow you to attach the hd as an external drrive and you can then do your recovery. no need to sacrifice an hd
While imaging can be the same as cloning, people generally mean it to be
1/ imaging = a snap shot of the files on the system, ignoring ~unused~ disk space. (but this could also be bit by bit)
2/ cloning = a much more specific thing, it means every last bit is copied exactly as it is on the disk. Cloning is usually used for forensic analysis.
@ OP: The most important thing for you to do is
~maintain~
~the~
~chain~
~of~
~evidence~
If you do find something, and you haven't done this,
whatever you find won't be valid in court.