DiskPart

<When using Colin Ramsden’s write protection application, you won’t have need to use Diskpart.  Only when relying solely upon the registry modifications and not using the write protection application will you need to use Diskpart.>

DiskPart is a much more powerful command line tool than FDisk. With that, there are also more/different commands available with DiskPart than FDisk. However, when using DiskPart as it relates to WinFE, there are really only a few commands to use.

DISKPART> List Disks This command will list all drives connected to the system. You should be able to determine which your evidence drive is and which is your destination drive.

DISKPART> Select Disk 1 Select your destination disk where you will store the image

DISKPART> Detail Disk If you are unsure of the disk selected, this command will give you more information about it

DISKPART> Online Disk If your destination drive is not online already, this will put it online

DISKPART> List Volume This command will list the volume(s) on your selected disk

DISKPART> Select Volume 1 Select the volume to where the image will be stored

DISKPART> Attribute clear readonly This will set your destination disk to read/write

DISKPART> Assign Letter=T This will assign a drive letter to your destination drive

DISKPART> Exit This will exit DISKPART, but keep the prompt open

For more information on DiskPart, check out the Microsoft DiskPart description. And don’t worry, this is not that difficult to use. Additionally, there is the upcoming GUI’d version of DiskPart being written and tested right now.