Invoke-IR / PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis
MIT License
1.38k stars 274 forks source link

Add Feature Invoke-ForensicDD #162

Open m4dm4n opened 3 years ago

m4dm4n commented 3 years ago

Hi,

Although it has a name DD in it, it's missing one usefull feature, and that's writing to DISK/VOLUME from some file. That way we could use it for backing up GPT Headers and tables, and then restoring it.

Another thing, parameter "-Offset" should really be renamed to "-Skip" (or use it as a completely new parameter), and counted in blocks ( based on size of the block). Let's have a medium sized 4TB disk, and we want to backup very last sector ( Backup GPTHeader). That's a large number, and mistakes could be made counting in bytes. Also, since disks are block based, we really should be thinking in blocks, not bytes.