On 15/02/2011 15:13, solefarmer (at) gmail (dot) com [email concealed] wrote:
> Ladies, Gentlemen, and otherwise:
>
> I have a situation whereby I need to obtain an image of an individual's laptop suitable for potential prosecution in a US court; however, I only have a limited window in which to grab the image, and was looking for alternatives in order to not "spook" the poor guy or his co-workers who would no doubt tell him about me, as I go into his office and randomly image his drive!

Here's one I have done in the past.
Use psexec, mapped drives, whatever to gain access to the machine while
running. rename ntldr to something else - next time the machine shuts
down, it won't come up again.

User screams, brings in machine for maint

Take out hard drive (and I mean take it out, physically remove it and
replace it with a new hard drive)

Clone old hard drive to new

Repair ntldr, return machine to user and tell him openly you "had to"
replace the hard drive - the old one was faulty - but you managed to
recover all his data; can he check he hasn't lost anything?

User goes away happy, you have the original drive for chain of evidence
purposes, and can image as many copies as you like.

>
> I thought about using P2V (Physical to Virtual), but realize that such software does make some steps to alter the system and thus may have court challenges. Is there possibility such could be explained in court, or perhaps md5 hash of his files(not the disk image) taken while online and then compared to a virtual image of sorts.
>
> Please advise, and I'm thinking of sending the winning submission a beer or two or some other minor token of appreciation.
>
>
>
>
> -----------------------------------------------------------------
> Certify Software Integrity - thawte Code Signing Certificates
> This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
> http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f
>
>
>

-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c8
72ea1f

[ reply ]