[sleuthkit-users] Creating practice images/drives

[Jennifer S. <g33...@li...>]

I mentioned this in an earlier message, but I thought it might be better to=
 break it off into a separate posting and to clarify my=20
question a little.

I asked if there is a how-to on creating images to practice with, basically=
 so that I can (in my spare time) work out the quirks in=20
what I am trying to do.

What I probably should have said was, what is the best way of setting up a =
drive in order to use it as a "forensic test case"?  In other words, if I w=
ant to have a drive that has X, Y, and Z items and then create the image (u=
sing dd) so that when I go to search the drive (using TSK, Autopsy, &/or ot=
her tools), I know that I should be able to find X, Y and Z, what is the be=
st way to go about that?  That way I can set up my own practice drive.

Barry, thanks for that reference guide - it looks like a great read, and I =
plan to use the .dd image for practice :)

Thanks for all the help!

-gg

--=20
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze