By default, Ghost performs only logical volume copies.

Ghost is a tool initially created for IT professionals to quickly clone data across numerous drives (such as a base “image” for a corporate hard-drive setup). Norton Ghost images are often provided to consultants with the representation that an image of the data was created. Helix is a forensic implementation of Linux that ensures that all drives attached to a machine the CD is used on will be write-protected until the user indicates otherwise.Īccess Data's Forensic Imager has the ability to create dd- and EnCase-formatted images, and its Forensic Toolkit will read certain versions of EnCase image files as well as dd. Many forensic practitioners run dd via Helix, a “Live” Linux CD-a self-contained operating system on a CD. Many variations of the dd program have been developed, including forensic implementations that automatically produce hash values of the image files and log any errors. “dd” is a Unix-based copy program that also copies data at the byte level. In addition to its own image files, EnCase can read dd image files. Depending on the version of EnCase used (Forensic Edition, Enterprise Edition) and the options selected (physical disk, logical volume, logical files), it can create a variety of permutations to produce images. EnCase images are byte-level images created with built-in cyclical redundancy checks (CRCs) and the EnCase software will detect when any part of the image file has been changed. An EnCase image is a proprietary file type created by Guidance Software's EnCase software for use with its software packages. You can create them either with software or with specialized hardware devices.ĮnCase is one of the most common image file formats created in forensic imaging.

In E-discovery: Creating and Managing an Enterprisewide Program, 2009 PCsįorensic images are a typical collection technique for PCs regardless of the operating system (Windows, Macintosh, Linux) they use.

Prodiscover basic disadvantages