Any action which require you to boot the device yourself will commit
changes, therefore the best method would be to set the hard drive
"offline" and mount it read-only as mentioned on the list.
Check also tools like sleuthkit but for your task a simple dd with a hash value
should ...
Any action which require you to boot the device yourself will commit
changes, therefore the best method would be to set the hard drive
"offline" and mount it read-only as mentioned on the list.
Check also tools like sleuthkit but for your task a simple dd with a hash value
should ...
[ more ]