Re: Forensic help?

[Paul Schmehl <pauls () utdallas edu>]

--On September 11, 2005 6:33:43 PM -0400 Red Leg <redleg18 () gmail com> wrote:

> Hi all.
>
> I was wondering if anyone knows of a program/system that I can purchase,
> as a private individual, that will allow me to
>
> 1) mirror a hard drive on location and
>
> 2) take that mirror and restore it to another drive. And
>
> 3) Find any CONVENTIONALLY erased files?
Download the knoppix std distro and burn it to a cd.  Use dcfldd for drive 
imaging and the forensics tools for recovery of erased files and the like.

>  -- This would be either a Windows NTFS or FAT32 drive.
Doesn't really matter what the OS was.  The tools work with bits, not OSes.

> Anyone have first hand experience? Please let me know, if you do. In ANY
> case, please suggest whatever you might have learned even without first
> hand experience.
I have used those tools as well as Encase and FTK.  Not sure what you mean 
by "might have learned".

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/