There’s an ongoing debate regarding the role of the public “trust” when performing an HDD cloning action.

What does a notary or a judicial clerk add to the action? And regarding the tools, is it better to use a single purpose device as a cloning machine or a multi-purpose one as a laptop computer?

In my humble opinion both the cloning machine and the notary/judicial clerk don’t add much more in a technical sense, but in fact they create an scenario in which it is less likely that the part that suffers the action will attack it in court.

As the time that takes to complete the action may be important, performance may be a factor in the decision, and here’s where the tittle comes in.

For some time now I’ve been experimenting with different means to acquire forensically sound disk images. The cloning machine I use is an Intelligent Computer Solutions Image MASSter Solo-3 Forensics. It can deliver 2,5GBpm when hashing SHA1 on SATA 7.200 drives. This means close to 7 hours for a 1TB drive…

I prefer to use the cloning machine when I perform the cloning procedure in court or with the intervention of a notary. When cloning big disks, I try to get the room locked while the copy is being performed and get back the next day to see the result.

But in other cases you may consider the following performance results the next time you need to perform a disk image:

• No hash 1.080GB/h
• MD5 923GB/h
• SHA1 923GB/h

So, what if instead of almost 7h you could perform a complete clone of a 1TB HDD in a bit more than 1h?

Enter the “poor’s man cloning machine”…

To build a “poor’s man cloning machine” you’ll need a laptop with a Express Card slot (the one I used in the tests is a Thinkpad T61, T8300, 4GB RAM), a 2x ports eSATA LaCie SATA II ExpressCard 34, 2x Conceptronic SATA&IDE to USB&eSATA adapter, 2x eSATA cables and boot media for any forensic distribution that comes with DCFLDD.

Total cost is aprox. 90€ + laptop.

Now here’s the trick…

I use to output the image to a file.

There’s times when you need things done NOW and Ext2/Ext3 FSs may take longer to create than NTFS, so I normally use NTFS as the destination FS.

You need to mount RW the target device using mount.ntfs-3g (or FUSE). If you call “mount” once you’ve done it, the result of the command for the device tells you abouy the next trick:

/dev/sdc1 on /media/sdc1 type fuseblk (rw, nosuid, nodev, noatime, allow_other, blksize=4096)

“blksize=4096”

If you let dcfldd choose the block size it will default to 32k, with an important impact in performance.

You must set obs=4k. In the same way, ibs is set to 32k by default, but you can explicitly set it to this value.

An example of command may be:

date; sudo dcfldd if=/dev/sdc of=/media/disk/image.dd ibs=32k obs=4k conv=sync,noerror hashwindow=0 hash=sha1 hashlog=hash_sha1.txt; date

You can set up a cloning machine that can eat a 1TB HDD in 1h, portable and using cheap components. It is ugly and has a lot of cables, but it really delivers.

P.S: A power strip is compulsory if you plan to use this setup. You will need (at least) 3 sockets: 1 for the laptop and 2 for the HDD adapters.