Back to list
*Note: Email address will appear as "user domain ext" to prevent harvesting.
Re: P2V - Live Forensics
Feb 21 2011 09:21PM
Adam Pal (pal_adam gmx net)
Any action which require you to boot the device yourself will commit
changes, therefore the best method would be to set the hard drive
"offline" and mount it read-only as mentioned on the list.
Check also tools like sleuthkit but for your task a simple dd with a hash value
[ more ]
Copyright 2010, SecurityFocus