HDD SuperClone Feature Request

Jared

Administrator
Staff member
While I don't actually do any forensics work, occasionally I've been asked to acquire a drive image along with an MD5 or SHA-1 checksum. Perhaps adding in a --forensic trigger (even if it's in the paid version) would be really awesome. Even if it just created a log file at the end with the drive's model and serial along with date & times imaging was performed along with the checksums and perhaps a list of unread blocks.

It might be a nice selling point for the paid version over the free.
 

Jared

Administrator
Staff member
True, but that would have to run after the fact which will mean sitting for another hour or two while it re-reads all the data to calculate it. I was thinking more of it having the ability to do it on the fly much like how software like FTK Imager does.
 

maximus

Member
I would like to say that I am not sure that HDDSuperClone should be used for forensics work. Because you are plugging the drive directly into a computer that could potentially perform operations on the drive, I could never say in court with 100% certainty that the drive had not been altered. While I take great pride in my software to make sure it does not perform writes or alterations on the source drive, I could never legally support it for forensics use.

I have no intention to add a checksum output, as it would add overhead and be about impossible to implement the way the program works. And as pointed out, there are free tools to do that.
 

Jared

Administrator
Staff member
maximus":xoicmq88 said:
I would like to say that I am not sure that HDDSuperClone should be used for forensics work. Because you are plugging the drive directly into a computer that could potentially perform operations on the drive, I could never say in court with 100% certainty that the drive had not been altered. While I take great pride in my software to make sure it does not perform writes or alterations on the source drive, I could never legally support it for forensics use.

I have no intention to add a checksum output, as it would add overhead and be about impossible to implement the way the program works. And as pointed out, there are free tools to do that.

One could use it along with a SATA write blocking bay. I've got a forensics operations server that I've picked up which could be used in tandem with your software to image drives, and I'd be certain that there was no modification since it's impossible at a hardware level.

But, if you wanted to do a software only bootable USB or something, then you'd probably need to use a stripped down core OS where you have more control over the packages installed.

I'd suspect though that builds such as Parrot Linux which is intended as a forensic acquisition live build would be safe to use along with hddsuperclone.
 

maximus

Member
Even so, it still is not really possible to include a checksum calculator on the fly. If any read errors are encountered, the program will skip, and come back later to attempt that data. And the program can also be stopped and restarted. I just don't see any way it could be done reliably on the fly the way things work in the program.
 
Top