Imaging Big Things
The Linux file system and available disk space limits your ability to image big things:
- Kernels < 2.3.5
- Kernel 2.3.5 (with a patch) and higher
- Physical disk limits
These images can not be checksummed in the same way as file images
Big things can be imaged elsewhere:
- To CD-ROMs
- To tapes
- To other disks
- To disk partitions not part of file systems
You can only do mounted analysis on whole file systems contained in:
- CDs, Partitions, files, and Network file systems