Forensic Tools

http://www.linuxforensics.com/forensics/knoppixmanual.pdf Live CD
knoppix
Penguin Sleuth
Helix from http://www.e-fense.com/helix
At knoppix prompt, type knoppix 2 noswap
# mount -ro /dev/hda1 /mnt/hda1
# mount -rw /dev/uba1 images ‘mount new drive
# md5sum /dev/hda1 > /images/dataorig.txt
# dd if=/dev/hda1 of=/images/dataorig.img
# md5sum /images/dataorig.img > /images/copy.txt
Compare the md5 sums. If same, then you have an identical copy.

Autopsy is a good forensic tool to crack hard drives.