Daily Blog #446: Sparse image blues

Sparse image blues by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
     A quick one before I fall asleep after a long day of ctf prep and Vegas fun. If you are using the fresponse imager to capture a full disk be aware that it seems to default to a sparse image format and leaves out shadow copies.

However imaging the same fresponse mounted image with another tool will capture the full disk.

Post a Comment