Don,

Can you provide the output of these commands issued from the laptop
system;

fdisk -l

blkid /dev/sda*

Instead of blowing across the network, are you able to attach a firewire
or USB hard drive to the laptop and blow your acquisition file via one
of those ports locally?

Also, based on your dcfldd command, you know that you are acquiring only
the first partition on the physical device, /dev/sda, yes?

If you want the physical device, remove the number from your command.
If you want only the partition continue on with your command then!

Cheers!

farmerdude

http://www.forensicbootcd.com

http://www.onlineforensictraining.com

[ reply ]