[Dshield] Forensics and hard drives
superc at visuallink.com
Tue Apr 10 14:03:12 GMT 2007
Well if I understand
correctly, I would need a server to run virtual server. Don't have one of those laying
around ($$$). I do like the idea of multiple sector imaged clones though, didn't think
of that. This is a fair size drive though (200 Gigs) so perhaps I will cook a dinner
instead of just having a cup of java while they copy.
I suppose that with multiple sector copies on hand I can just put one in a PC enclosure
without a connection to anything besides monitor, keyboard and a CD drive, and let it
boot and run, then run the tools (Helix, etc.) on it.
I'm thinking that if I hit a boobytrap and it self formats or something then for the
next copy I will avoid that keystroke combination. :)
More information about the list