Re: [sleuthkit-users] dd of entire HD

[David B. <to...@so...>]

Paul,
since you have the partition table you can 'dd' each partition from the
entire disk (for example dd if=disk of=hda1 bs=1024 count=XX skip=XX)
where count and skip can be obtained from the partition table (or each
extended partition table).