Hi everyone - I am new to Linux . . . here is what I am trying to do. I need to image a 17 Gig hard drive that is FAT32 (has Windows ME on it). I am using the PSK version of Knoppix to do the imaging. My target drive is a FAT32 formatted hard disk that is partitioned several times - All FAT32. I am using the following command:

dcfldd if=/dev/hda1 of=/mnt/hdb1/image.dd conv=noerror,sync hashwindow=0 hashlog= hash.txt

This stops after 2 Gigs of copying due to the FAT32 file size limit being exceeded. How do I get around this? If I am imaging a FAT32 drive, does the drive I am copying to also need to be FAT32 file system (as opposed to linux file system, or some other file system that supports image files of 20 Gigs or more)? Is it even possible with any filesystem to create a 17 Gig image file?

Also, for you forensic experts, what is the advantage of imaging a drive over just cloning it? In other words, why would I want to create an image as opposed to a bit-for-bit copy of one drive to another? All of the forensic material I have refers to image files rather than a cloned copy of the hard disk. Why is that?

Also, when imaging a drive, is it better to image it partition by partition or to just image the entire drive into one image file - all partitions included?

Thanks so much in advance.

Brian