How to remove Windows control over my... Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Support Forum » Miscellaneous » How to remove Windows control over my slave hard drive?? « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

nicolas mella
Username: nmella

Registered: 6-2006
Posted on Thursday, Apr 26, 2007 - 21:21:   
Hi,

I need to create a forensic image of a hard drive....but If I connect the drive to Windows XP, it will add a letter or path to the drive ("D:\" for example) and will write some few sectors to it.......so the image will not be as the original drive.

So I need to windows XP not to add a letter automatically to the drive (as windows 2003 server). How can I achive this?

Maybe I could disable secondary IDE and windows will not see the drive but Winhex will, but what if it is a SCSI drive?

Please, any advice ?

Thanks
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Apr 26, 2007 - 22:45:   
The only solution I know to create an image of a hard disk in a forensically sound way from within Windows is to use a hardware write blocking device.
Top of pagePrevious messageNext messageBottom of page Link to this message

Mike Montgomery
Username: mikemjm

Registered: N/A
Posted on Thursday, Jun 14, 2007 - 17:06:   
If you wipe the target drive before creating the image. Windows will not allocate a drive letter.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have an account.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.