Security Strategies in Linux Platforms and Applications, 3rd Edition

Secure Backup and Recovery Tools

You use backup and recovery tools to make copies or images of suspect media, normally hard drives. The standard Linux tool for this is the dd, or disk dump, command. It copies every bit of a storage volume in a format that can be copied to an image. The alternative is the rsync command, which is well suited to copying files, preserving all relevant data such as links and last access times.

Disk Images for Later Investigation

Although the dd command is still the standard, other excellent commands are available for disk imaging. One of the benefits of the dd command is that it copies everything, even the universally unique identifier (UUID) number associated with the drive or volume. To that end, the simplest ...