Anyone care to recommend a good tool used for field acquisition of a HDD in the field that is forensically sound? I have a customer who wants to pay me to drive two hours away to image a drive and attempt recovery. I already know lawyers are involved, and I keep telling them I'm not a forensics person, but they are very insistent.
I know a million ways to make a perfect clone, but just in case this does turn into an investigation later I'd rather err on the side of caution and do it all forensically sound right now.
I know a million ways to make a perfect clone, but just in case this does turn into an investigation later I'd rather err on the side of caution and do it all forensically sound right now.