1. Use the main bootparameter “forensic”
2. Clone/save harddisk using dd, dcfldd or even ewfacquire

You can build your own forensic live system using grml-live. grml-live already provides a GRML_FORENSIC class.

• “forensic” is a shortcut for “apm=power-off boot=live nomce vga=791 readonly quiet nofstab noraid nolvm noautoconfig noswap raid=noautodetect”

A list of imaging tools included in grml:

• dd - for sure
• dcfldd
• ddrescue
• libewf (open source library including tools for building and restoring EWF images, both EnCase (EWF-E01) and SMART (EWF-S01))
• sdd

For further details see TODO list of Debian Forensic team.

• grml-forensic in the grml wiki
• grml-forensic mailinglist
• Debian Forensics
• forensicswiki.org