I guess there is one point here that leads to possible issues a cd to forensically collect evidence for law enforcement would require that you collect the data with a device that could not write to the hard disk, or alter data in any way. The issue with a disk that would collect real-time as the OS was logged in with a administrator would give you the ability to change the data prior to collection, thusly you don't have credibility on the collection of the data in its original form.
as for your 20 min problem, I assume that your hitting a timeout of file access due to permissions, so you might want to code in a error routine so that your not waiting on windows API to time out. I created a super "slurp" tool a while back primarily used for backup of data in a flash, also for non-legal investigation work. On Nov 7, 2007 5:41 AM, Matthew Webster <[EMAIL PROTECTED]> wrote: > Hello, > > I am almost finished creating a live data collection forensic CD, but > I've noticed it is slow (20 minutes when it should be 3-5 minutes) when > running on computers that are not logged in as administrator. I could use > PSexec or runas or something to log in as administrator, but I have a concern > that this may alter important information on the computer. The question I > have is, what is the best policy when creating a forensic boot disk? Is it > best to wait for the information or have the CD log in as local administrator > to collect information in a timely fashion before shutting down? I do have > the local admin password so that is not an issue. I am talking about windows > boxes. > > Thanks, > > Matt > > >
