Low-intrusive consistent disk checkpointing: a tool for digital forensics

Digital forensics is an area of increasing importance. An important problem is to record a checkpoint of a disk drive mounted as a file system on a host machine without disrupting the disk's normal operations. We present a checkpointing methodology for any disk that has a Unix-like file system. While our algorithm is built around the Unix file system, it can be used to checkpoint disks formatted for other file systems such as NTFS, etc. Our algorithm satisfies several correctness conditions. Currently, we are implementing the techniques on the PC platform running Linux Red Hat version 8.0.