I'm new to forensics and I don't know yet what I'm allowed to do or not.
I would like to know if I'm allowed to issue the following command hdparm -I /dev/sdb where /dev/sdb is the hard drive to duplicate?

The idea here is to gather information about the hard drive before begining the duplication. Of course in this case, the hard drive is connected to a write block device.

  • So your asking if running that command will somehow modify the data stored on the disk or otherwise affect the forensic value of it. Correct? Sep 19 '15 at 1:11
  • Correct. This is exactly what i want to know.
    – Othman
    Sep 19 '15 at 1:23

It depends.

hdparm -I asks the drive, that is the firmware in the drive will reply to this command. If you consider the drive itself innocent and only the data stored on the drive the problem then this command probably does not harm. But if you deal with a case where the firmware might be manipulated then this command might change information which would have been important for the forensic analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.