OSFClone is a free, self-booting solution which enables you to create or clone exact raw disk images quickly and independent of the installed operating system. In addition to raw disk images, OSFClone also supports imaging drives to the open Advance Forensics Format (AFF). AFF is an open and extensible format to store disk images and associated metadata. An open standard enables investigators to quickly and efficiently use their preferred tools for drive analysis.
After creating or cloning a disk image, you can mount the image with PassMark OSFMount before conducting analysis with PassMark OSForensics™.
The software is self-booting which means that it is independent of operating systems installed on the system. It is based on Tiny Core Linux and boots into a command line interface and not a graphical user interface.
Your first task is to burn the ISO image to DVD, or to copy the contents of the zip file to an USB drive. The USB installation requires additional steps, like launching ImageUSB.exe once you have copied the files to the drive. The steps are explained in detail on the developer homepage.
You end up with a self-booting image that you can start instead of the installed operating systems. This can also be handy if the operating systems are not starting anymore.
The program loads its basic interface and displays the available options in a text menu. You can use the keyboard to select an entry from the available options.
OFSClone can create raw images of a selected drive or partition, or disk images in the Advance Forensics Format. You need to have enough free space available to create the disk image.
Another interesting option is the ability to verify that the cloned drive is identical to the drive source, which is done by comparing hashes between the clone and source drive.
You can then mount the created image on the same or another computer to analyze, access or recover its contents.
OSFClone is easy to use. That, and the fact that it is OS independent make it an interesting tool for users who want to copy or clone a hard disk on a computer system. The program is currently free of charge, and it remains to be seen if this stays this way, or if the developers have intentions to charge for it in the future.
After creating or cloning a disk image, you can mount the image with PassMark OSFMount before conducting analysis with PassMark OSForensics™.
The software is self-booting which means that it is independent of operating systems installed on the system. It is based on Tiny Core Linux and boots into a command line interface and not a graphical user interface.
Your first task is to burn the ISO image to DVD, or to copy the contents of the zip file to an USB drive. The USB installation requires additional steps, like launching ImageUSB.exe once you have copied the files to the drive. The steps are explained in detail on the developer homepage.
You end up with a self-booting image that you can start instead of the installed operating systems. This can also be handy if the operating systems are not starting anymore.
OFSClone can create raw images of a selected drive or partition, or disk images in the Advance Forensics Format. You need to have enough free space available to create the disk image.
Another interesting option is the ability to verify that the cloned drive is identical to the drive source, which is done by comparing hashes between the clone and source drive.
You can then mount the created image on the same or another computer to analyze, access or recover its contents.
OSFClone is easy to use. That, and the fact that it is OS independent make it an interesting tool for users who want to copy or clone a hard disk on a computer system. The program is currently free of charge, and it remains to be seen if this stays this way, or if the developers have intentions to charge for it in the future.
No comments:
Post a Comment