#Prodiscover basic view image os how to#
#Prodiscover basic view image os mac osx#

In step two вЂњdestinationвЂќ, we set the destination of the image file where we want to store it, in my case I used D: drive and named the image вЂњ DarknessGate_USBвЂќ, the acquired image has the extension. In my case I select drive Q: which is my USB drive. In the step one we select the source drive that we want to capture, this could be a removable disk, USB drive or just one of the partition of the main disk of the computer. The steps in red are mandatory, while the green one is optional In main program window, click on вЂњCapture & add imageвЂќ Install the program using simple steps with the default settings.ДЇirst star ProDiscover, a pop up window may appears, this windows allows you to enter project number, name and description as follow: If the link changed go to and search for it. Also avoid using backup software to have an image of the original drive as backup software cannot copy deleted files, emails and fragment files however in some cases it will be necessary to use backup software in order to recover data from damaged hard disk however the integrity of files is not guaranteed in the last case.Дownload ProDiscover program from the following link

Important note: a sector-by sector image (known also as bit-stream image) is different from performing a copy of the disk using standard windows copy/paste function, as this will not copy hidden data and slack spaces. Let us first describe what we mean by a drive image copy, a disk image is a file that contains the exact same data and structure information as the original one, we can have this image through performing a sector-by sector image copy of the original disk, in this way we perform a replication of the same original disk.

#Prodiscover basic view image os how to#

The first thing we need to do when conducting computer investigations is to have a copy of the suspect drive, in this tutorial Iam going to show you how to use ProDiscover basic software tool to acquire and analysis a suspect drive.

#Prodiscover basic view image os mac osx#

Windows XP, Vista, Win 7, server 2008 (all versions)ДЄll Windows based file systems including FAT 12/16/32/exFAT and NTFS Dynamic disks in addition to file systems such as SUN Solaris UFS and Linux Ext 2/3/4, and Mac OSX HFS+