you could try partimage, that will give the option of auto splitting
Hi everyone - I am new to Linux . . . here is what I am trying to do. I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). I am using the PSK version of Knoppix to do the imaging. My target drive is a FAT32 formatted hard disk that is partitioned several times - All FAT32. I am using the following command:
dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0 hashlog= hash.txt
This stops after 2 Gigs of copying due to the FAT32 file size limit being exceeded. How do I get around this? If I am imaging a FAT32 drive, does the drive I am copying to also need to be FAT32 file system (as opposed to linux file system, or some other file system that supports image files of 20 Gigs or more)? Is it even possible with any filesystem to create a 17 Gig image file?
Also, for you forensic experts, what is the advantage of imaging a drive over just cloning it? In other words, why would I want to create an image as opposed to a bit-for-bit copy of one drive to another? All of the forensic material I have refers to image files rather than a cloned copy of the hard disk. Why is that?
Also, when imaging a drive, is it better to image it partition by partition or to just image the entire drive into one image file - all partitions included?
Thanks so much in advance.
Brian
you could try partimage, that will give the option of auto splitting
eh? the filesizelimit is 4G NOT 2g.
there is something wrong here.
you could use a ext2/3 filesystem and store the entire image there, there is NO need for the image of a fat32 to be on a fat32 disk.
Yes, but I've also met a 2 gig barrier for FAT32Originally Posted by OErjan
if it is the mount bin that messes up that must be if you have not given fat=32 in the mount option, i think it is older versions of dd that has the limitation, should be fixed by now.
A-Tech 8GB DDR3 1600 PC3-12800 Laptop SODIMM 204-Pin Memory RAM PC3L DDR3L 1x 8G
$13.99
Samsung 16GB 2Rx4 PC4-2133P DDR4-17000 1.2V RDIMM ECC Registered Server Memory
$16.29
HyperX FURY DDR3 8GB 16GB 32GB 1600 MHz PC3-12800 Desktop RAM Memory DIMM 240pin
$12.90
A-Tech 16GB 2 x 8GB PC3-12800 Laptop SODIMM DDR3 1600 Memory RAM PC3L 16G DDR3L
$27.98
Kingston HyperX FURY DDR3 8GB 16GB 32G 1600 1866 1333 Desktop Memory RAM DIMM
$13.25
A-Tech 8GB PC3-12800 Desktop DDR3 1600 MHz Non ECC 240-Pin DIMM Memory RAM 1x 8G
$13.99
HyperX FURY RAM DDR4 16GB 8GB 32GB 4GB 3200 2666 2400 2133 Desktop Memory DIMM
$9.64
Samsung 16GB (2x8GB) PC3L-12800S Lap Top Memory RAM
$20.00
A-Tech 256GB 4x 64GB 4Rx4 PC4-19200 ECC Load Reduced LRDIMM Server Memory RAM
$287.96
Samsung 64GB 4DRx4 PC4-2400 LRDIMM DDR4-19200 ECC Load Reduced Server Memory RAM
$71.99