21 May
2009
21 May
'09
3:41 p.m.
on 5-21-2009 1:18 AM Daniel Bird spake the following:
dd is a good idea. I'll dd these disks and try with the images.
If you DD the entire drive, here is a howto I found for mounting the partition you want from the image.
Thanks Scott, That was going to be my next question! ;-)
D
You can also just dd from the partition you want if just for recovery. It makes it easier to loopback mount several partitions. I used to do this occasionally when I took some forensics work at the local PD. Long before the certs were even heard of, much less available.