1

I'm new to forensics and I don't know yet what I'm allowed to do or not.
I would like to know if I'm allowed to issue the following command hdparm -I /dev/sdb where /dev/sdb is the hard drive to duplicate?

The idea here is to gather information about the hard drive before begining the duplication. Of course in this case, the hard drive is connected to a write block device.

Improve this question
2
  • So your asking if running that command will somehow modify the data stored on the disk or otherwise affect the forensic value of it. Correct?
    – Neil Smithline
    Sep 19, 2015 at 1:11
  • Correct. This is exactly what i want to know.
    – Othman
    Sep 19, 2015 at 1:23

1 Answer 1

Reset to default
2

It depends.

hdparm -I asks the drive, that is the firmware in the drive will reply to this command. If you consider the drive itself innocent and only the data stored on the drive the problem then this command probably does not harm. But if you deal with a case where the firmware might be manipulated then this command might change information which would have been important for the forensic analysis.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .