RE: P2V - Live Forensics

Encase.

Art Bahrs, CISSP
Security Engineer (Oregon Region)
(503) 216-2722


-----Original Message-----
From: [email protected] [mailto:[email protected]] On=
 Behalf Of [email protected]
Sent: Tuesday, February 15, 2011 7:14 AM
To: [email protected]
Subject: P2V - Live Forensics

Ladies, Gentlemen, and otherwise:

I have a situation whereby I need to obtain an image of an individual's lap=
top suitable for potential prosecution in a US court; however, I only have =
a limited window in which to grab the image, and was looking for alternativ=
es in order to not "spook" the poor guy or his co-workers who would no doub=
t tell him about me, as I go into his office and randomly image his drive!


I thought about using P2V (Physical to Virtual), but realize that such soft=
ware does make some steps to alter the system and thus may have court chall=
enges. Is there possibility such could be explained in court, or perhaps md=
5 hash of his files(not the disk image) taken while online and then compare=
d to a virtual image of sorts.

Please advise, and I'm thinking of sending the winning submission a beer or=
 two or some other minor token of appreciation.




-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure c=
ode that can be downloaded from the Internet. You will also learn how these=
 certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872e=
a1f




This message is intended for the sole use of the addressee, and may contain=
 information that is privileged, confidential and exempt from disclosure un=
der applicable law. If you are not the addressee you are hereby notified th=
at you may not use, copy, disclose, or distribute to anyone the message or =
any information contained in the message. If you have received this message=
 in error, please immediately advise the sender by reply email and delete t=
his message.


-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f