Re: [sleuthkit-users] avoiding creating a dd image

[Angus M. <an...@n-...>]

On Thursday 17 June 2004 09:56, amouri eddy wrote:
> Hello,
>
> For analysing a system (booting with a live linux CD), it is possible to
> mount the disks. But the sleuth kit requires images, so images of the disks
> must be created. Is it possible to find a way to directly analyse the disk
> (creating images may takes a long long time and one need another hd) ?
>
> Thanks

You can symlink the disk device entry (e.g. /dev/sda1) instead of imaging but 
this is not recommended practice for legal reasons in most jurisdictions.

> ---------------------------------
> Yahoo! Mail : votre e-mail personnel et gratuit qui vous suit partout !
> Créez votre Yahoo! Mail
>
> Dialoguez en direct avec vos amis grâce à Yahoo! Messenger !