If you are a Unix command line geek you can clone your hard disk with various Linux programs. This can be quicker if you feel comfortable using the Linux shell. Computer forensics need to use a Unix live CD to clone a hard drive in order to preserve all data from alteration but unless this is your case you do not need it.

How to clone a hard disk using dd?

To execute dd you should login as root or use the su command.

1- Open Linux terminal window as root.

2- Change appropiate hard disk name, ie sda/sdb and type:

dd if=/dev/sda of=/dev/sdb

3- Cloning a hard drive using dd can take hours depending on size. You can use gzip and save storage space but this will make the hard disk back up even longer.

Copying a hard disk partition using dd

If you don’t want to make a complete duplication of your hard disk the following command will create an image file “disk1.img” in your user’s recovery directory from /dev/sda

dd if=/dev/sda of=~/recovery/disk1.img

To restore a partition or a hard disk from an image file, just exchange the arguments “if” and “of”. For example, restore the whole hard disk from the image file “disk1.img”:

dd if=disk1.img of=/dev/sda

How to clone your hard drive using ddrescue?

Also known as Gddrescue in Ubuntu, ddrescue is quicker than ‘dd’, gets better results and it also keeps a logfile that records each of the bad blocks found.

1- SystemCdTools includes ddrescue but you may have to install dderescue from the repositories otherwise as many other linux distributions do not come with it.

2- Open Linux terminal window as root.

3- Change source sda and destination sdb if needed, depending on your hard disk name, then type:

ddrescue -v /dev/sda /dev/sdb

If your hard disk has bad sectors the following Linux ddrescue command line below will attempt to recover them:

ddrescue -r 1 /dev/sda /dev/sdb rescue.log

WARNING: There is another Unix tool called dd_rescue do not confuse it with ddrescue, they both enhance dd but are not the same command line.

Hard drive data kept secure

Main Linux live CD to clone a hard disk

CloneZilla: Clonezilla live is suitable for single machine backup and restore, Clonezilla saves and restores only used blocks in the harddisk, this increases the clone efficiency. This live CD to mirror your hard disk can be a bit overwhelming for newbies not used to Linux.

Redo Backup and Recovery: The system uses minimal space and resources, and the download size is less than 75MB. Easy point-and-click GUI tool for full system backup and recovery, very user friendly.

SystemRescueCD: This Linux live CD is normally used to recover data, you can use it to backup data from an unbootable Windows computer not able to boot anymore, as long as the hard disk is still working, you will just need to mount the partition.

UltimateBootCD: You can use this Linux live CD for hard disk cloning using some of the tools it has, such as CopyWipe, g4u, HDClone, partimage and others. You can also use this Linux live CD for data wiping as it includes hard disk wiping tools such as  Darik’s Boot and Nuke (DBAN) and HDDErase.

PartedMagic: This is mainly a linux live CD used for partioning but it also includes CloneZilla from the command line.

GRML: For the advanced linux user, this linux live CD based on Debian has been designed for the Linux system administrator comfortable witht the command line, GRML provides security and network related software, data recovery and forensic tools and many text tools.

Hard drive cloning

Computer Forensics live CD to clone hard drive

Frenzy: FreeBSD live CD, it contains software for hardware tests, file system check, security check and network setup and analysis.

Caine: Ubuntu based computer forensics live CD, mainly used to acquire data of a suspected criminal computer but also useful as a back up live CD. User friendly graphical interface.

DEFT Linux: DEFT it’s a new concept of Computer Forensic live system that use LXDE as desktop environment and thunar file manager and mount manager as tool for device management. It is a very easy to use system that includes an excellent hardware detection as well as open source applications dedicated to incident response and computer forensics.

MasterKey: MasterKey Linux live CD is focused on incident response and computer forensics. No installation is required, the forensics system is started directly from the a CD/DVD-ROM or USB thumbdrive.

BackTrack: BackTrack has been customized down to every package, kernel configuration, script and patch solely for the purpose of the penetration tester. You can install Backtrack to USB with full disk encryption if needed. 

Computer forensics live CD Caine

This excellent Linux Journal video introduces Mixmaster and explains how you can download it to your own Unix machine and help the internet anonymity cause running an anonymous email server.

Mixmaster runs on *BSD, Linux and Microsoft Windows. If you have questions about remailers and Mixmaster one of the best points of calls is the newsgroup: alt.privacy.anon.server

You can read the mailing list for remailer operators, and subscribe, at:

http://lists.mixmin.net/mailman/listinfo/remops

Mixmaster remailer software homepage:

http://mixmaster.sourceforge.net/

Stop the history file keeping a copy of typed in commands

This can be used any time  you like assuming you have administrator rights (using bash shell as example).

# kill -9 $$

$$ gives the pid of the current shell instance, and the kill ends the process.

You could also use the history command, see man history:

# history -c (clear the history)
# history -w (write to the file – overwrite!)

Delete the bash history file, find out where your shell saves the history of typed in commands and delete it the same way. You may also use the shred command to overwrite it safely.

# rm -rf ~/.bash_history

But even if you delete the ~/.bash_history file, your current bash session will still be written to history once you log out, this is because it is being stored in RAM, you will need to use the previous history -c command to avoid this.

Stop writting to the history file for good

Examples based on the bash shell configuration files:

Turn off bash history for all users, append unset HISTFILE to /etc/profile

# echo “unset HISTFILE” >> /etc/profile

Set size of the history to zero:

HISTSIZE: The number of commands to remember in the command history. The default value in bash is 500, You can set this to 0 and disable the usage of the history file.

Introduce the following command in your personal bash configuration file ~/.bashrc (~/.zshrc for the zsh shell users) or in the global bash configuration file /etc/bash.bashrc

export HISTSIZE=0

You will need to restart your bash session in order to activate the settings, you can check if your configuration were entered correctly by going at the command prompt and typing:

env

If you don’t see your configuration in the environment variables than you have done something wrong.

The name of the configuration files can depend from your Linux distribution and bash version, you can always see your particular options using man bash.

Unix shell configuration files

Unix shell configuration table files explained:

• Blank means a file is not read by a shell at all

• “yes” means a file is always read by a shell upon startup

• “login” means a file is read if the shell is a login shell

• “n/login” means a file is read if the shell is not a login shell

• “int.” means a file is read if the shell is interactive

• “i.login” means a file is read if the shell is an interactive login shell

To find out what shell you are using type: echo $SHELL

To change your shell see chsh –help