problems cloning a hard drive with dcfldd

[email protected] Wed, 6 Aug 2008 13:14:23 -0700 (PDT)
Newsgroups gmane.comp.security.linux
Message-ID <39909f02-d791-409e-8d56-40938840164f@default>
Hello,

I am a newbie to this whole digital forensics world, and am having a proble=
m cloning a hard drive.

Setup:
laptop with 40gb harddrive with 2 partitions. The laptop had/has windows xp=
 on it, but it won't boot any longer.
desktop system running fedora 9 as my forensics lab machine.
fedora livecd containing dcfldd and some other  tools.

Situation:
I boot the laptop using the livecd and login no problem.
I can see the hard drive as /dev/sda.

Both systems are connected to my local network.

I want to make a clone of the laptop harddrive so that I can use it to lear=
n some of the forensic tools available like sleuthkit mac-robber etc.

Steps:
on desktop: start netcat in listening mode port 1234
on laptop run:
dcfldd if=3D/dev/sda1 conv=3Dnoerror,sync hash=3Dmd5 hashlog=3Dmd5.log | nc=
 desktopsystem 1234 -w 3

All seems to be going just fine the netcat connection is made and dcfldd is=
 displaying its progress.
However, at block 98513, I get an error from dcfldd saying:

error:/dev/sda1 input output error

and the whole process stops.

I tried:
$ dcfldd if=3D/dev/sda1 of=3D/dev/null conv=3Dnoerror,sync

and it processed the entire 34gb without an error.

Any suggestions would be appreciated for how to get this drive cloned.