Re: forensic imaging and the host protected area on ATA drives (was Two hash)

In-Reply-To: <002901c4f171$cdbef9a0$d2c8f181@PDS.LOCAL>

Vogon's Windows based imaging software uses our write-protection hardware and 
the user is warned that hidden sectors are present on the disk and is allowed 
to image the visible area or whole disk or any area he choses. Our write 
blocking hardware protects SCSI, ATA, SATA and PCMCIA disks/media & also allows 
our Password Cracking Pod to be attached.

Note that PCMCIA devices may also be resized (and frequently are) and our 
software behaves exactly the same with a PCMCIA device as it would with a ATA 
or SATA disk drive. 

We have not encountered any restrictions under Windows regarding the use of ATA 
commands nor indeed with write protection hardware.

Any software or hardware which removes the hidden sector area from the source 
disk during the imaging process is self-evidently modifying the source disk. 
This is not necessary and could give rise to problems.

It is not a good enough arguement to suggest that missing disk 
data does not matter. Taking a correct image is the most important part of the 
computer forensic process - fail to do this correctly without modifying the 
source drive and there is probably no point proceeding any further.



Gordon Stevenson
http://www.vogon-international.com

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com