full-disclosure - Forensic help?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <63cec55305091611057c1b8367@mail.gmail.com>
Date: Fri Sep 16 19:05:33 2005
From: compuwar at gmail.com (Paul Robertson)
Subject: Forensic help?

On 9/12/05, Nick FitzGerald <nick@...us-l.demon.co.uk> wrote:
> Anyway, much as I am an _only very occasional_ user of Ghost, I don't
> think I've ever used it NOT to make a sector-level, or raw disk image,
> style drive copy.  However, as I last used it so long ago, I decided to
> check I was not mis-remembering -- two seconds at Google turned up this
> URL discussing "...the Ghost switches to use for forensic imaging or
> for creating raw images (sector copies)..." (URL may wrap):
> 
> http://service1.symantec.com/SUPPORT/ghost.nsf/docid/2001111413481325?Op
> en&src=&docid=19

G'day Nick,

While you *can* use Ghost to get a complete image, the switches change
from version to version and it's really a PITA to test what does what
when.  Most folks I know if the field have decided there's too much
room for error with Ghost.  Also, it means more to document, which is
bad for the lazy ;).

Paul
-- 
www.compuwar.net