--On September 11, 2005 6:33:43 PM -0400 Red Leg <[EMAIL PROTECTED]> wrote:
Hi all.
I was wondering if anyone knows of a program/system that I can purchase,
as a private individual, that will allow me to
1) mirror a hard drive on location and
2) take that mirror and restore it to another drive. And
3) Find any CONVENTIONALLY erased files?
Download the knoppix std distro and burn it to a cd. Use dcfldd for drive
imaging and the forensics tools for recovery of erased files and the like.
-- This would be either a Windows NTFS or FAT32 drive.
Doesn't really matter what the OS was. The tools work with bits, not OSes.
Anyone have first hand experience? Please let me know, if you do. In ANY
case, please suggest whatever you might have learned even without first
hand experience.
I have used those tools as well as Encase and FTK. Not sure what you mean
by "might have learned".
Paul Schmehl ([EMAIL PROTECTED])
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
