full-disclosure - Forensic help?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <32C57BF3666DB9290970D1E2@Paul-Schmehls-Computer.local>
Date: Mon Sep 12 01:21:44 2005
From: pauls at utdallas.edu (Paul Schmehl)
Subject: Forensic help?

--On September 11, 2005 6:33:43 PM -0400 Red Leg <redleg18@...il.com> wrote:

>
> Hi all.
>
> I was wondering if anyone knows of a program/system that I can purchase,
> as a private individual, that will allow me to
>
> 1) mirror a hard drive on location and
>
> 2) take that mirror and restore it to another drive. And
>
> 3) Find any CONVENTIONALLY erased files?
>
Download the knoppix std distro and burn it to a cd.  Use dcfldd for drive 
imaging and the forensics tools for recovery of erased files and the like.

>  -- This would be either a Windows NTFS or FAT32 drive.
>
Doesn't really matter what the OS was.  The tools work with bits, not OSes.

> Anyone have first hand experience? Please let me know, if you do. In ANY
> case, please suggest whatever you might have learned even without first
> hand experience.
>
I have used those tools as well as Encase and FTK.  Not sure what you mean 
by "might have learned".

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/