full-disclosure - Forensic help?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <a9f81f4005091115492439c924@mail.gmail.com>
Date: Sun Sep 11 23:49:56 2005
From: jjjwicks at gmail.com (James Wicks)
Subject: Forensic help?

Here is a way to do it on the cheap:

1. Ghost the hard drive with "Symantec Ghost" - 
http://www.symantec.com/sabu/ghost/ghost_personal/

2. Take the original drive with you and put a new drive in the machine

3. Copy the Ghost image on the new drive, allowing the system to go back 
into production

4. Take the suspect drive and install it in another system with the same 
configuration as the original. Run "RecoverMyFiles" 
http://www.whitecanyon.com/rmf-hard-drive-data-recovery.php or "File Recover 
5.0" http://www.pctools.com/file-recover/?ref=google_fr

The whole thing should cost you about $140 in software cost and the cost of 
a replacement hard drive.

JJJ

 -----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk [mailto:
full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Red Leg
Sent: Sunday, September 11, 2005 6:34 PM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Forensic help?

  Hi all.

 I was wondering if anyone knows of a program/system that I can purchase, as

a private individual, that will allow me to

 1) mirror a hard drive on location and

 2) take that mirror and restore it to another drive. And

 3) Find any CONVENTIONALLY erased files?

 -- This would be either a Windows NTFS or FAT32 drive.

 Anyone have first hand experience? Please let me know, if you do. In ANY

case, please suggest whatever you might have learned even without first hand

experience.

 Thanks!

 Redleg18

  _______________________________________________

Full-Disclosure - We believe in it.

Charter: http://lists.grok.org.uk/full-disclosure-charter.html

Hosted and sponsored by Secunia - http://secunia.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050911/d31bb341/attachment.html