Best Way to Copy Contents of HD

wvjohn · Post by **wvjohn** » Thu Aug 28, 2003 10:51 am

I need to copy the contents of a ~30 gb HD - I believe it is win me and fat32 - to another drive so that we can do a layman examination of the contents of the HD

I have some old 98 machines in the office but their bios does recognize a 40 GB HD which is what i have to copy on

I have xp pro machines but they are NTFS and will only format HD as NTFS

If i format the blank HD in ntfs will i be able to get a meaningful copy of the fat32 drive? by meaningful, i mean able to use simple tools to look for deleted files, chat logs, etc. this is just to get some idea of what is on the hard drive, not for a full forensic examination

i understand that a full forensic would require a bit by bit copy and a lot of sophisticated tools and $$ which we don not have to spend atm

copy tools i have avail are ghost 5.1c (dos) and I think a copy of acronis somewher ebut i've never used it

can an xp pro machine read fat32 files?

can an xp pro machine use a dos copy program like ghost to make a copy fat32>fat32?

TIA

dadx2mj · Post by **dadx2mj** » Thu Aug 28, 2003 11:25 am

XP can read and run on FAT32 or NTFS. I would think that Ghost would be a good way to go.

DocSilly · Post by **DocSilly** » Thu Aug 28, 2003 11:26 am

Lemme see ... you want to copy an old 30GB to a 40GB and both are not from your WinXP PC?

It is true that WinXP won't format it in FAT32, it is artificially limiting itself to max FAT32 size of ~30GB to enforce NTFS on the users but it can read/write to larger FAT32 partitions.
But you could use a regular Win98 bootdisk and use the trusty FDISK/FORMAT DOS-combo.

You can use % values in case your FDISK is an older version that doesn't correctly identify 30+GB drives, just use 100% when you create the new partition. You could now use the DOS XCOPY to copy all of the 30GB to the 40GB but that isn't always 100% reliable regarding long filenames.

You can then put both HDDs into your WinXP PC and copy all content from the 30GB to the 40GB using the explorer.

Using Ghost is another option to image the 30GB on the 40GB drive.

Some useful guides:
- FDISK guide
- Ghost guide

MK888 · Post by **MK888** » Thu Aug 28, 2003 2:56 pm

I need to copy the contents of a ~30 gb HD - I believe it is win me and fat32 - to another drive so that we can do a layman examination of the contents of the HD

Examine the contents of the original HD right?

will i be able to get a meaningful copy of the fat32 drive? by meaningful, i mean able to use simple tools to look for deleted files, chat logs, etc. this is just to get some idea of what is on the hard drive, not for a full forensic examination

Above tells me that you will be looking for deleted files on the copy.... If that is the case, then ghost would be the only answer. A simple file copy will not copy deleted files, but a drive image through ghost will...I think..... When running ghost you have to do a partition to partition image.

You may run into a problem because the new drive is bigger. Ghost adjusts the partition size to fill the new drive, and thus you may lose some of the data. If this is your route, match the destination partition size of the new partition to the old.

If you are trying to do this on the QT, you should try and find a 30GB drive, ghost the old to the new, and put the new one into the machine, and keep the old one for study.

wvjohn · Post by **wvjohn** » Thu Aug 28, 2003 3:43 pm

lots of good info so far from everyone - thanks!

the computer is currently in possesion of the authorities (belongs to a client)

we need to get some idea of what is still on there/what was there

we do not have the capabilities to establish where stuff came from, etc., just trying to get some general ideas of how the computer was used

mk888 - if I format the new hd to the same size as the old hd (which is unknown atm) will that solve the difference in partition size problem you mentioned?

i am going to be allowed to make a copy of the hd under supervision, then it goes back

my idea was to just have computer A with an os HD and a clean hd on ide 1 and hook up the to-be-copied hd as a slave on ide 2 and ghost it

all suggestions are still welcome

chottoED · Post by **chottoED** » Thu Aug 28, 2003 5:03 pm

acronis partitioning utility is one of the fastest complete no nonsense copiers i've ever used

Sean · Post by **Sean** » Thu Aug 28, 2003 11:15 pm

I don't see why you can't use Ghost? ghost can copy anything to anything at any size. I copied 18 gigs worth of stuff from my 40gig to a 20gig. It copies whatever it is, including FAT32, NTFS, whatever. It read both my drives fine, which use NTFS.

Stick in a floppy, and tell it to copy and it's all good. You shouldn't have any hassle with anyone, it starts and finishes, and that's it.

MK888 · Post by **MK888** » Thu Aug 28, 2003 11:18 pm

In the ghost situation, no..... When you do a partition copy using ghost, it blows away anything on the destination drive. It is pretty easy to make them match (the partition sizes). When ghosting, you will get a screen that tells you the "old size", and the "new size" of the partition being copied. Just make the new size, match the old size, and you are good.

Unfortunatly I am not positive, that it is going to copy the deleted data. You must do a disk to disk clone. Do not create an image file. An image file will only take the data, and will probably leve anything that was deleted behind.

VidmanII · Post by **VidmanII** » Sun Aug 31, 2003 10:08 pm

PowerQuest Drive image.

wvjohn · Post by **wvjohn** » Thu Sep 04, 2003 11:48 am

ended up using Acronis for the copy which was easy to use - i like the feature where it will mount the image as a hd and then you can nose around with explorer

i also found a program called winhex which looks promising - the flagship forensic program appears to be encase, but it is pricey

thanx to all as usual