Reply to thread

Message

<blockquote data-quote="DDE_Server" data-source="post: 928606" data-attributes="member: 65727">I am studying CHFI course Right now.one of the questions which popped up in my mind . what the difference between Imaging software and backup solution, Forensic science to try to imaging/Duplicate the original evidence wit minimal interaction with the system to avoid the corruption of the evidence after investigation ?? is that the only difference. for example software called R-Drive used for imaging with extension .dd why not taking a backup with for example Norton ghost to take ghost image ??R-drive also need to be installed on the live machine &quot;it isn&#039;t portable for example which mean it will avoid creating additional process in the process table what is the advantage here?? is it the type of the data for example &quot;Which may be raw format and ne analyzed in hex editor software <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" /> ?? let is have your opinion gents</blockquote>

[QUOTE="DDE_Server, post: 928606, member: 65727"] I am studying CHFI course Right now.one of the questions which popped up in my mind . what the difference between Imaging software and backup solution, Forensic science to try to imaging/Duplicate the original evidence wit minimal interaction with the system to avoid the corruption of the evidence after investigation ?? is that the only difference. for example software called R-Drive used for imaging with extension .dd why not taking a backup with for example Norton ghost to take ghost image ?? R-drive also need to be installed on the live machine "it isn't portable for example which mean it will avoid creating additional process in the process table what is the advantage here?? is it the type of the data for example "Which may be raw format and ne analyzed in hex editor software :unsure::unsure::unsure: ?? let is have your opinion gents [/QUOTE]

Verification