Forensics
P2V - Live Forensics Feb 15 2011 03:13PM
solefarmer gmail com (10 replies)
Re: P2V - Live Forensics Feb 22 2011 10:18AM
Dave Howe (DaveHowe pentest googlemail com) (1 replies)
Re: P2V - Live Forensics Feb 28 2011 04:59PM
Paul Schmehl (pschmehl_lists tx rr com) (1 replies)
RE: P2V - Live Forensics Mar 02 2011 09:36AM
David Howe (David Howe ansgroup co uk) (1 replies)
Re: P2V - Live Forensics Mar 03 2011 03:14AM
Chris Barber (cmbarber gmail com)
Re: P2V - Live Forensics Feb 21 2011 09:21PM
Adam Pal (pal_adam gmx net)
RE: P2V - Live Forensics Feb 21 2011 09:21AM
Brian Hitchen esure com
Re: P2V - Live Forensics Feb 19 2011 10:46AM
quark quark (quark maillist gmail com) (1 replies)
Re: P2V - Live Forensics Feb 21 2011 03:40AM
tchmielarski gmail com (1 replies)
DD on a live system, using netcat (both exist for windows), will allow you to image to a separate system over the network. You can remotely run it, assuming you have access (or better yet, an IT person who will run a batch script on your behalf) using psexec. Dcfldd will hash the image as you create it.

Sent via BlackBerry by AT&T

-----Original Message-----

From: quark quark <quark.maillist (at) gmail (dot) com [email concealed]>

Sender: listbounce (at) securityfocus (dot) com [email concealed]

Date: Sat, 19 Feb 2011 12:46:12

To: <solefarmer (at) gmail (dot) com [email concealed]>

Cc: <forensics (at) securityfocus (dot) com [email concealed]>

Subject: Re: P2V - Live Forensics

well if you have access to the machine isnt "DD" a good option, as in

using it form a boot disk to get an image thus avoiding any changes to

the disk!

my little 2 cents,

On Tue, Feb 15, 2011 at 5:13 PM, <solefarmer (at) gmail (dot) com [email concealed]> wrote:

> Ladies, Gentlemen, and otherwise:

>

> I have a situation whereby I need to obtain an image of an individual's laptop suitable for potential prosecution in a US court; however, I only have a limited window in which to grab the image, and was looking for alternatives in order to not "spook" the poor guy or his co-workers who would no doubt tell him about me, as I go into his office and randomly image his drive!

>

>

> I thought about using P2V (Physical to Virtual), but realize that such software does make some steps to alter the system and thus may have court challenges. Is there possibility such could be explained in court, or perhaps md5 hash of his files(not the disk image) taken while online and then compared to a virtual image of sorts.

>

> Please advise, and I'm thinking of sending the winning submission a beer or two or some other minor token of appreciation.

>

>

>

>

> -----------------------------------------------------------------

> Certify Software Integrity - thawte Code Signing Certificates

> This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.

> http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f

>

>

>

-----------------------------------------------------------------

Certify Software Integrity - thawte Code Signing Certificates

This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.

http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f

[ reply ]
Re: P2V - Live Forensics Feb 26 2011 12:51AM
Valdis Kletnieks vt edu
Re: P2V - Live Forensics Feb 18 2011 04:55PM
Thomas Rozenbroek (trozenbr gmu edu)
RE: P2V - Live Forensics Feb 18 2011 01:36PM
Dan Gimenez (dan gimenez comcast net)
Re: P2V - Live Forensics Feb 18 2011 12:38AM
Erin Kenneally (erin elchemy org)
Re: P2V - Live Forensics Feb 17 2011 11:01PM
William Warren (hescominsoon emmanuelcomputerconsulting com)
Re: P2V - Live Forensics Feb 17 2011 10:54PM
w ahlstros (wahlstros gmail com)
RE: P2V - Live Forensics Feb 17 2011 10:52PM
Bahrs, Art (Arthur Bahrs providence org) (1 replies)
Re: P2V - Live Forensics Feb 21 2011 03:24AM
Paulo Cesar Breim (PCB) (paulo breim com br)


 

Privacy Statement
Copyright 2010, SecurityFocus