Differences

This shows you the differences between two versions of the page.

--- todo:removable-flash-media [2022/05/10 15:52] – hiccup
+++ todo:rewritable_hard_disks_and_flash_media [2026/01/02 23:16] (current) – hiccup
@@ Line 1: / Line 1: @@
-====== Removable Flash Media ======
+====== Rewritable Hard Disks and Flash Media ======
 ===== Introduction =====
+{{wst>factory_save}}
-{{wst>factory_save_shared_rom_and_save}}
+There is a risk when plugging USB devices or other writeable storage media into a conventional operating system that the OS will write to the device, meaning a clean dump of the original media cannot subsequently be made. To enable as clean as possible a dump to be preserved - even in the case of used devices it is good to avoid making any further changes. Note that the write-protect switches that some SD cards doesn't actually prevent writes - if it works, it just tells the reader to not write to the card - not all readers will comply with this.
-There is a risk when plugging USB devices or other writeable storage media into a conventional operating system that the OS will write to the device, meaning a clean dump of the original media cannot subsequently be made. To enable as clean as possible a dump to be preserved - even in the case of used devices it is good to avoid making any further changes.
+This method uses a forensics-oriented Linux distribution which defaults to blocking all devices in read-only mode to ensure as secure as possible an environment (without using a hardware write blocker) for imaging of writeable storage media.
-This method uses a forensics-oriented Linux distribution which defaults to blocking all devices in read-only mode to ensure as secure as possible an environment for imaging of writeable storage media.
+{{wst>dumping_important_notes}}
 ===== Methods =====
@@ Line 16: / Line 17: @@
 ==== Method 1 ====
-[todo: elaborate]
 **Tools required**
   * External USB drive of at least 4GB OR a writeable DVD
@@ Line 63: / Line 62: @@
 {{:todo:flashmedia-step9.png?600|}}
 {{:todo:flashmedia-step10.png?600|}}
-  * Open the console and dump the USB using the following command 'sudo dd if=/dev/sdX/ of=/media/caine/$HARDDRIVE/backup.img bs=4M status=progress'
+  * Open the console and dump the USB using the following command 'sudo dd if=/dev/sdX of=/media/caine/$HARDDRIVE/backup.img bs=4M status=progress'
 {{:todo:flashmedia-step11.png?600|}}
 ===== Gathering and Submitting Dump Info =====
 See [[submission:general|Gathering and Submitting Dump Info (Basic)]]