Have you consider using a "Live-CD" Linux solution such as Knoppix? It
is my understanding that there is a tailor version of Knoppix designed
to do this type of forensics, but I have not seen or used it personally.

Respectfully,

thr
-----
What I have completed does not matter;
it is only what I...

[ more ]