Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: Sergioramos
New Today: 1
New Yesterday: 0
Overall: 29353

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 A question for students and newbies
 E-DISCOVERY & DATA RECOVERY? WHICH ONE IS BETTER?
 Computer Forensic in e-commerce
 Computer Forensic as component in Information Security
 Small Business - Do You Prepared?

Computer Forensics World Forums


Pages Served
We received
51193739
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Two e01 forensic image on one larger drive !
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Two e01 forensic image on one larger drive !

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues
View previous topic :: View next topic  
Author Message
Thomas30
Newbie
Newbie


Joined: Nov 22, 2016
Posts: 4

PostPosted: Tue Nov 22, 2016 7:03 pm    Post subject: Two e01 forensic image on one larger drive ! Reply with quote

Hello,
Is it good to acquire e01 forensics binary copy from two discs on one larger disc ? From example I have two discs - one 120GB, second 320GB, and I do binary copy of them on one larger disc from example 1TB.
Except from fact that when I physically damage that 1TB disc I lose both of binary copies of that (120, 320) discs.
What are others disadvantages of doing this ?
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Tue Nov 22, 2016 10:14 pm    Post subject: Reply with quote

There is nothing wrong with imaging multiple disks to a single disk. Not much different than imaging multiple disks to a RAID.

Hmmm. Disadvantages. If consent or legal authority was revoked for one of the original items you imaged you would have to show you properly deleted it. There is always the chance of a hardware failure and you lose both image files before making your backup copy. I am sure there are other disaster scenarios as well.
Back to top
View user's profile
Thomas30
Newbie
Newbie


Joined: Nov 22, 2016
Posts: 4

PostPosted: Tue Nov 22, 2016 11:25 pm    Post subject: Thanks :) Reply with quote

I thought it is maybe not a "good practise" in IT Forensics doing two binary copies on the same drive.
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Wed Nov 23, 2016 11:14 am    Post subject: Reply with quote

There are no issues with the practice of putting multiple images on the same drive.
Back to top
View user's profile
SgtJackie
Newbie
Newbie


Joined: Dec 01, 2015
Posts: 19
Location: Aberdeen, Scotland

PostPosted: Fri Nov 25, 2016 12:11 am    Post subject: Reply with quote

There's no reason you can't do that if you want to, just make sure that a) there is enough room on the drive for both - leave some overhead, b) it's been forensically wiped before re-use c) you have hashed both the originals and the copies to make sure they are identical.
Back to top
View user's profile
Thomas30
Newbie
Newbie


Joined: Nov 22, 2016
Posts: 4

PostPosted: Sat Nov 26, 2016 6:16 am    Post subject: Reply with quote

Thanks for your answers
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> General Computer Forensic Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.