I need clone or image a hard drive which will include the deleted files.

Toggle sidebar Toggle sidebar
M

mike0921

Honorable
Oct 8, 2012
13
0
10,510
A friend of mine owns a company and his bro-in-law has been keeping the books for the last 6 years. He has never allowed my friend to see them. My friend who operates the company and is responsible for the success, has figured out that he thinks the last 2 cars and a house has been bought illegally by his bro-in law and sis.

He is bringing me the tower over and wants me to clone, or image (am unsure of the exact terms...) the disk with all the books on them, including the deleted files by his brother. I don't know of a program that copies "empty" blocks, and that's what I need in order to do my forensic accounting magik and produce evidence one way or the other... He does have all the paper produced by/in the company since the Articles of Incorporation including every bank statement and paper checks.... (until the last 3 years when the bank quit including the cancelled checks.) I have rebuilt books from that kind of paper for companies before, and I sure would like to ghost the drive, recover as many of the files as I can and go from there. It will be a 6 month job if I am lucky if all I have is paper.

Can someone tell me of a freeware program that will reproduce/clone his drive to include the deleted files to a disk on my PC? Than I can go to work in my environment.

I have done all the bits and pieces of this before over the years except for the cloning/imaging/ghosting of deleted blocks....

If no freeware than how about "anyware?"

Thanks,
 
Sort by date Sort by votes
D

Deleted member 217926

Guest
If he seriously thinks theft on the level of new cars and houses has been committed then he either needs to notify his local authorities or even the feds. Since I don't know what kind of company or where the funds might be stolen from anyone from the IRS to the FBI might be interested.

The worst thing you can do is go in with little to no computer knowledge and risk destroying what might be considered evidence. Sounds like a good way to go to federal pound me in the ass prison to me. Leave it alone. Notify the authorities and let them conduct any forensic work.
 
Upvote 0 Downvote
M

mike0921

Honorable
Oct 8, 2012
13
0
10,510
I did this kind of thing for about 15 years. I was a Bus. Consultant for 18 years overseas and here and have degrees in Bus. Communications, Accounting, CIM, three of four, and was a legal strategist for two companies for the last five years of the 18. I worked with similar issues. Forensic accounting is something I am familiar with and a lawyer is involved. I have had other issues I have been dealing with for the last 25 years a large part has had to do with IT. I simply haven't worked with cloning drives so was looking for some thoughts on that to answer some questions and shorten the learning curve and keep expenses down. I am very familiar with the concerns over the FBI and the IRS and chain of custody and the variety of accounting and business, legal and ethics issues involved, on these issues I am versed.

What I was looking for was information on cloning/imaging software which would include all blocks on the HDD, both used and those having been deleted. Replacing the HDD would be an ethics and legal issue and since serial numbers are easy to read was already discussed with the owner. I have recovery software which I have used and am familiar with. I am just trying to shortcut educating myself on duplicating, block for block the original HDD.

So, any help on software which would clone/image the unused or deleted blocks as well as those currently holding information?

Thanks for all your help so far, all legitimate concerns and I appreciate them, but can any one save me some time and money in my original query? I have three other clients, two with IRS issues and my time is limited to only so many hours a day. :)

Thanks to everybody for their time and thoughts.
 
Upvote 0 Downvote
M

mike0921

Honorable
Oct 8, 2012
13
0
10,510
A left out thought and comment. Everyone so far seem to have the badges which would indicate that the software question I have is obtainable from you. Can you help me with that?

Thanks in advance...
 
Upvote 0 Downvote
USAFRet

USAFRet

Titan
Moderator
Mar 16, 2013
171,755
18,128
184,590


EaseUS Disk Copy "It is free disk/partition clone software only for private & home computer usage. Sector-by-sector copy method assures you a 100% identical copy to the original."

Possibly CloneZilla

Test these first on another system to make sure it actually copies any deleted (marked as free space) data.
 
Upvote 0 Downvote
M

mike0921

Honorable
Oct 8, 2012
13
0
10,510
Thank you USAFRet. Even though my father was USMC retired ( he flew, and was a squadron commander, in SBD's in the Pacific in WWII) I would never let a small thing like that get in the way!

I will go obtain both and try them today/tomorrow. I'll let you know...

If anyone else knows, has experience, with these two or others that would help answer my original query, please, I would appreciate your input as well...

Thanks again USAFRet, I am a great friend and hold in high regard every career military person, having only served a few short years after a ROTC education, as well as the education by my career Marine Corp. fighter/dive bomber pilot father!
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom