Disk Image of my Windows Partition
I am taking a class this semester on computer forensics. I am playing with a tool called SleuthKit (http://www.sleuthkit.org/). The data I need to analyse is my windows xp partition on the same computer.
SleuthKit says to use the program "dd" to make an image of things. Is there anyway for me to make an image of my windows xp partion?
Here is an example of what they suggest:
Basically, is there something under /dev that would point to my windows partition is mostly what I need to know.
dd if=/dev/hdd of=/mnt/disk.dd bs=4k
(p.s., fairly new to linux)
Thanks in advance,