digitalcoroner wrote:
I have tried FTK Imager 3.1.2 and FTK 5.0 to take a physical image off of a hard drive that has a HPFS/NTFS partition. The partition always shows up as unrecognized. The hard drive is encrypted using SAFENET. I've tried imaging with the hard drive in the laptop and logged in as admin and have taken the hard drive out and directly connected to an imaging station. FTK never prompts for SAFENET credentials either. Thanks.
Since you are going for a physical image (I presume of the whole disk, not just of the partition/volume) why don't you try with a "plainer" dd (or similar)?
Physical image - in theory - should be completely filesystem/partitioning scheme/whatever "agnostic", it should be a simple byte by byte, sector by sector copy of the original.
Is it not that - for whatever reason, connected or not connected with SAFENET - that hard disk has HPA (or similar "hidden" content)?
jaclaz
↧