I've been through the NTI training and worked with their tools. I can tell
you from personal experience that it is quality training and the tools are
very valuable. If the process is still the same (I was there years ago),
you have to attend the training to get many of the tools - they don't just
hand them out to anyone.
-----Original Message-----
From: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
To: weird old drewbie <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED] <[EMAIL PROTECTED]>
Date: Friday, April 14, 2000 5:39 PM
Subject: Re: Off Topic: Forensics
>Hi,
>
>The March 2000 issue of Information Security Magazine had an article about
forensics and forensic software -
www.infosecuritymag.com/march2000/forensics.htm
>
>Some of the tools mentioned are from NTI www.forensics-intl.com and
Encase - www.guidancesoftware.com
>
>Also, check out Dan Farmer's forensics page at
http://www.fish.com/security/forensics.html
>
>Ben
>
>
>"weird old drewbie " <[EMAIL PROTECTED]>
>Sent by: [EMAIL PROTECTED]
>04/14/2000 06:02 AM PST
>
>To: [EMAIL PROTECTED]
>cc:
>bcc:
>Subject: Off Topic: Forensics
>
>
>
>
>We had an employee leave "under a cloud" a few months ago. Litigation is
pending.
>
>The hard drive was removed from the employee's desktop computer and was
replaced before the computer was assigned to another employee.
>
>Before leaving my finger and footprints all over the disk in the process of
retrieving the information wants, I need to make a backup copy of the disk
in the condition I received it.
>
>This is a W98 system on a garden variety Intel desktop box.
>
>There is too much I don't understand in this eviornment. I concerned that
reqular backup up and restore will dink with date information that may
become significant later.
>
>I'm looking for a tool that will make a low level sector by sector copy of
the disk, preserving all OS datastructures.
>
>I believe it should as a D:\ drive not a C:\ drive to keep the W98 from
running amok adjusting things that should be left alone.
>
>Any other precautions?
>
>Suggestions for a better place to ask these questions?
>
>
>--== Sent via Deja.com http://www.deja.com/ ==--
>Share what you know. Learn what you don't.
>-
>[To unsubscribe, send mail to [EMAIL PROTECTED] with
>"unsubscribe firewalls" in the body of the message.]
>
>- [To unsubscribe, send mail to [EMAIL PROTECTED] with "unsubscribe
firewalls" in the body of the message.]
>
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
