Log in as administrator with live data collection CD?

Matthew Webster <[email protected]> Wed, 7 Nov 2007 08:41:08 -0500 (GMT-05:00)
Newsgroups gmane.comp.security.forensics
Message-ID <19945439.1194442868756.JavaMail.root@mswamui-andean.atl.sa.earthlink.net>
Hello,

    I am almost finished creating a live data collection forensic CD, but I've noticed it is slow (20 minutes when it should be 3-5 minutes) when running on computers that are not logged in as administrator.  I could use PSexec or runas or something to log in as administrator, but I have a concern that this may alter important information  on the computer.  The question I have is, what is the best policy when creating a forensic boot disk?  Is it best to wait for the information or have the CD log in as local administrator to collect information in a timely fashion before shutting down?  I do have the local admin password so that is not an issue.  I am talking about windows boxes.

Thanks,

Matt