Create image file with dd

[hookem1994]

I need to create a file for forensic analysis (EnCase). I made a copy of the drive with dd:
dd if=/dev/rdsk/c0t12d0s2 of=/dev/rdsk/c0t10d0s2

However I would like to make a copy with dd and have all the data inputed into a single file for extraction to the forensic tool.

Any help would be greatly appreciated.

Thanks,
Hookem1994

 

[hookem1994]

The system is running Solaris 8.

 

[fredericofonseca]

the of= can be any type of file, so if you have enough space available to store the drive size you can do

dd if=/dev/rdsk/c0t12d0s2 of=my_personal_file

I haven't done in a while, but you may also be able to do something like

dd if=/xxx |tar -cvf /dev/"tapedevice" -

to copy to a tape instead.




Regards

Frederico Fonseca
SysSoft Integrated Ltd

http://www.syssoft-int.com