X-Ways Replica 1.3 Forensically sound DOS-based hard disk cloning and imaging tool. Copyright 2002, 2003 X-Ways Software Technology AG http://www.x-ways.net Version History --------------- 1.3: Image files created read-only. More in-progress information. 1.2: Disk imaging (option to write to an image file) 1.0: Log file option 0.95: "Ignore always" option fixed 0.94: Ability to work with un-partitioned hard disks 0.9: First release Legalities ---------- May be used by registered owners of Evidor, by users of the evaluation version of Evidor for the duration of the evaluation period, and by owners of a WinHex specialist license only. Must not be re-distributed. Why use X-Ways Replica? ----------------------- A forensic examination usually should not be performed on the original subject drive. X-Ways Replica is an easy- to-use tool that creates clones of entire hard disks as well as single hard disk partitions (with any file system). The clones are forensically sound, exact bit-by-bit copies, including all unused space and slack space. This enables you to perform the examination on the clone instead. Most Windows environments would access the original drive without asking, once newly attached, thereby e.g. altering the last access dates of some files on the original drive. This can be avoided using X-Ways Replica, as it runs in plain DOS mode, like on a DOS floppy boot disk. An MS-DOS startup disk can be easily created from inside Windows 2000 and XP when formatting a floppy disk using the Windows Explorer. X-Ways Replica does not run in a DOS box under Windows 2000 or XP. Hints on Usage -------------- The source and the destination hard disk must both be attached to the same system and recognized by the BIOS. The destination must be of the same size or larger than the source. If this is not the case, Replica will warn you. The destination may also be an image file and you specify the maximum file size at which the output file will be split and another segment will be started. On FAT file systems this is necessary due to their file size limitations (FAT16: 2 GB, FAT32: 4 GB). However, this option is also useful to prepare segments ready for backup on CD (650 MB). Image files are created with the read-only attribute set. WinHex is able to interpret all image file segments as a single large image file if they are located in the same folder. You provide the name for the base image file (the first segment), either with no filename extension, a non- numeric extension, or ".000". The second segment will have the same base name, and the extension will automatically be incremented like ".001" (second segment), ".002" (third segment), and so on. When X-Ways Replica cannot successfully read a sector from the source disk because it is physically damaged, you will prompted whether to write zero bytes instead or leave the corresponding sector on the destination disk untouched. In case you are copying the sectors to an image file, not to another disk, X-Ways Replica will always choose to write zero bytes without asking. You may also have X-Ways Replica write a log file about the cloning process. That way you will not be prompted during program execution either, and zero bytes will be written in case of bad sectors at any rate. The log file option is generally useful to keep exact records on which sectors/ partitions were cloned, when (date and time), which sectors or partitions were selected as the destination, which sectors were copied successfully, which sectors were bad, etc. During the cloning process you may press ESC for a clean interruption, including log file finalization, or Ctrl+ Break to immediately abort the program. Remember, you must use great caution when selecting the destination disk, as all data on that disk will be LOST. Similarly, if the output goes to an image file, if the image base file or any subsequent segment already exists, it will be OVERWRITTEN, even though it is marked as a read-only file.