Symantec 10024709 manual Require forensic images

Command-line switches

Command-line switches

159

-id	The image disk switch is similar to -ia (image all), but also copies the boot track, as in -ib
	(image boot), extended partition tables, and unpartitioned space on the disk. When
	looking at an image with -id, you see the unpartitioned space and extended partitions in
	the list of partitions. The -id switch is primarily used by law enforcement agencies that
	require forensic images.
	When Norton Ghost restores from an -id image, it relocates partitions to cylinder
	boundaries and adjusts partition tables accordingly. Head, sector, and cylinder
	information in partition tables is adjusted to match the geometry of the destination disk.
	Partitions are not resizeable. You will need an identical or larger disk than the original.
	Norton Ghost does not wipe the destination disk when restoring from an -id image.
	Geometry differences between disks may leave tracks on the destination disk with their
	previous contents.
	Use the -ia (image all) switch instead of the -id switch when copying partition-to-partition
	or partition-to-image. An individual partition can be restored from an image created with
	-id.
-imgdesc	Adds a single-line image file description to the image file. This has the following
	restrictions:
	■ Cannot include any new lines
	■ Cannot be used with -imgdescfile
	■ Must be used with the clone switch
	■ Clone switch mode must be create, dump, prcreate, or pdump
-imgdescfile	Specifies a text file that contains an image file description to be added to the image file.
	This has the following restrictions:
	■ Cannot be used with -imgdesc
	■ Must be used with the clone switch
	■ Clone switch mode must be create, dump, prcreate, or pdump
-ir	The image raw switch copies the entire disk, ignoring the partition table. This is useful
	when a disk does not contain a partition table in the standard PC format, or you do not
	want partitions to be realigned to track boundaries on the destination disk. Some
	operating systems may not be able to access unaligned partitions. Partitions cannot be
	resized during restore and you need an identical or larger disk.
-jl:x=filename	Creates a log file to assist in diagnosing problems with TCP/IP connections. The amount
	of information logged is set by the log level, x. The log level x can be E (errors), S
	(statistics), W (warnings), I (information), or A (all), in increasing order of logging detail.
	The file name indicates the path and file name of the log to be created. In general, the error
	and statistic levels do not affect session performance. All other levels may reduce
	performance and should be used for diagnostic purposes only.
-lockinfo	Shows the type code and information stored in the BIOS or the Pentium III Processor ID.
	For example: