I've been busy for awhile now, we're using Helix in my digital forensics class...it's fascinating, to say the least...
I have a bit of an issue though.
We're using VMware to test out acquiring and cloning images of hard drives. The premise is that we mount "suspect" hard drives in Helix in read-only, and then we use Adepto to obtain a .dd image of said hard drive, saving the image to a separate hard drive.
However, whenever I try and use Adepto to restore the image to another hard drive, the restore fails due to the fact that the hash values do not match. A simple restart of the Helix live CD helps this, but I'd like to see if there's any other option before restarting. Has anyone else had this happen to them? I'm thinking it may just be VMware, but I need a second opinion.
Thanks for reading
