How to mount a HDD for forensics?

Asked Jan 11 '15 at 16:53

Active Jan 11 '15 at 16:53

Viewed 192 times

What command flags are needed with Linux's mount to mount a hard drive without leaving any trace on it? Do I just need noatime?

asked Jan 11 '15 at 16:53

user403723

1

If you mount it as read-only, you will not be able to change it in any way. – AFH Jan 11 '15 at 16:58
Alright, that's good. Doing so will prevent anyone from ever knowing I LiveUSB'ed into their computer and looked at their hard drive?
I could still copy files off it though, right?
– user403723 Jan 11 '15 at 17:02
1

possible duplicate of Why are write blockers needed when there is mount with read-only? – Ƭᴇcʜιᴇ007 Jan 11 '15 at 17:06
Yes to both, unless the BIOS has some sort of trace in it. – AFH Jan 11 '15 at 17:08
I have just looked at @Ƭᴇcʜιᴇ007's link, and it seems I was a little simplistic. You should read the answers there. – AFH Jan 11 '15 at 17:12
Just throwing this out there, but would it be acceptable for you to "dd" the entire device to something like a file on another disk and the mount the file as a loopback device? I've done this before with damaged SD cards in order to recover lost pictures so that I don't disturb the original device. – jia103 Jan 11 '15 at 18:09

0 Answers0