Pro/Forums - View Single Post

Redux · 02-09-2008, 06:45 PM

I have managed to create an image with the Forensic Acquisition Utilities version of DD. Saveral things are different when doing this on windows. First you need to determine what PHYSICALDRIVE number for the drive you want to clone is. I used WMI Object Browser which is part of WMITools to look up the drive number needed. If you have only 2 drives its likely that the snap drive is PHYSICALDRIVE1 where PHYSICALDRIVE0 is your win boot disk. The other difference is that the default count=25000 used in the wiki was insufficient so i used count=125000

Here are the commandsIi used
HD to IMG
dd if=\\.\PHYSICALDRIVE1 of=c:\snap.bin bs=1024 count=25000 conv=noerror --localwrt

IMG to HD
dd if=c:\snap.bin of=\\.\PHYSICALDRIVE1 --localwrt

I will post more when i have a bit more time.

02-09-2008, 06:45 PM	#4
Redux Cooling Neophyte Join Date: Apr 2007 Location: Indonesia Posts: 15	Re: make dd image under windows I have managed to create an image with the Forensic Acquisition Utilities version of DD. Saveral things are different when doing this on windows. First you need to determine what PHYSICALDRIVE number for the drive you want to clone is. I used WMI Object Browser which is part of WMITools to look up the drive number needed. If you have only 2 drives its likely that the snap drive is PHYSICALDRIVE1 where PHYSICALDRIVE0 is your win boot disk. The other difference is that the default count=25000 used in the wiki was insufficient so i used count=125000 Here are the commandsIi used HD to IMG dd if=\\.\PHYSICALDRIVE1 of=c:\snap.bin bs=1024 count=25000 conv=noerror --localwrt IMG to HD dd if=c:\snap.bin of=\\.\PHYSICALDRIVE1 --localwrt I will post more when i have a bit more time.