Not actually relevant to the perl bit, but when you say "copy the harddisk for forensics then reformat" surely you mean "pull out the old disk, put it somewhere safe, put the new disk in" Disks are cheap, doing so will ensure the 'copy' is 100% perfect and most importantly, won't take ages to copy across, while your server is sitting unusable.

the hatter