Hello,

I need to make a sector by sector image of 3 SCSI drives that are part of a RAID 5 volume so I can work with the images in attempts to logically rebuild the RAID container with R-Studio.

I need to get the images while maintaining the forensic integrity of the physical hard drives (i.e not writing to them in any way).

I have a Tableau Read-Only capable SCSI to USB device, however, the Windows operating system I'm using won't "see" the drives unless they are initialized into the operating system. This procedure fails as I have the Read-Only feature enabled on the Tableau device. I have a couple questions about this:

1. When the OS (Windows XP Pro) initializes the drive from the Disk Management Snap-in, what is actually written to the drive and can this be "reversed" after the fact? (i.e. can I later remove what was written to the drive during this process via winhex or equivelent?)

2. Is there any software that will make an image of a drive that has not yet been initialized into the OS?

3. What do you professionals use to get an image from a drive without writing to it?

Thank you for your time and help in this matter.

James

R-Studio SHOULD see the raw drives even if windows doesn't
then just use R-Studio to image the drives..
Winhex should work also
Or you can use Dos based imagers such as media tools pro

Thanks Steve. R-Studio did exactly what I wanted. I'm still learning how powerful that program actually is. Thanks and sorry for the dumb quesiton.