Windows: Getting forensic image from truecrypt container (opened) and getting forensic image from nonopened truecrypt container

Hello,

i would like to know to to get a dd image from truecrypt container which is allready mounted

AND

i would like to know how to get it when the file is not mounted.

My environment is a windows box. All Solutions should be freeware.

regards

bytes
LVL 5
ByteSleuthAsked:
Who is Participating?
 
Dave HoweConnect With a Mentor Software and Hardware EngineerCommented:
to get it while mounted:

download and unzip http://www.chrysocome.net/dd

use the command dd if=\\.\k: of=drive.img bs=10M

where k: is the drive it is mounted on (change to suit)
drive.img is the target file (must be enough space to store an uncompressed image of the drive)
and 10M is the buffer (chunk) size during the copy - larger sizes mean faster copies, but more memory used.

to get it while not mounted:

just copy the file :)
0
 
ByteSleuthAuthor Commented:
Hello

thanks a lot :-)

Here are your points...
0
 
ByteSleuthAuthor Commented:
Thanks a lot buddy.
View my other questions about truecrypt-----
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.