[sleuthkit-users] Previewing drives

[Jon N. <qu...@li...>]

Does anyone know if using the device name (e.g., /dev/hda1) as the image
file for Autopsy will alter the drive?

I tested this with a floppy and the MD5 did not change.  I was going to d=
o
some more intensive testing, but I don't want to re-invent the wheel.

One reason I would want to do this is to eliminate large drives from a
case without having to image them, while still getting the functionality
of Autopsy.

TIA,

Jon

--=20
Trooper Jon S. Nelson, Linux Certified Admin., CCNA
Pa. State Police, Bureau of Criminal Investigation
Computer Crimes Unit
Work: 610.344.4471 Cell/Page: 866.284.1603
jon...@st...