[Dshield] Forensics and hard drives

superc superc at visuallink.com
Tue Apr 10 14:03:12 GMT 2007


Well if I understand
http://www.microsoft.com/windowsserversystem/virtualserver/evaluation/vsoverview.mspx
correctly, I would need a server to run virtual server.  Don't have one of those laying
around ($$$).  I do like the idea of multiple sector imaged clones though, didn't think
of that.  This is a fair size drive though (200 Gigs) so perhaps I will cook a dinner
instead of just having a cup of java while they copy.  


I suppose that with multiple sector copies on hand I can just put one in a PC enclosure
without a connection to anything besides monitor, keyboard and a CD drive, and let it
boot and run, then run the tools (Helix, etc.) on it.  


I'm thinking that if I hit a boobytrap and it self formats or something then for the
next copy I will avoid that keystroke combination.  :)





More information about the list mailing list