Re: P2V - Live Forensics

On Tue, Feb 15, 2011 at 9:13 AM,  <[email protected]> wrote:
> Ladies, Gentlemen, and otherwise:
>
> I have a situation whereby I need to obtain an image of an individual's l=
aptop suitable for potential prosecution in a US court; however, I only hav=
e a limited window in which to grab the image, and was looking for alternat=
ives in order to not "spook" the poor guy or his co-workers who would no do=
ubt tell him about me, as I go into his office and randomly image his drive=
!
>
>
> I thought about using P2V (Physical to Virtual), but realize that such so=
ftware does make some steps to alter the system and thus may have court cha=
llenges. Is there possibility such could be explained in court, or perhaps =
md5 hash of his files(not the disk image) taken while online and then compa=
red to a virtual image of sorts.
>
> Please advise, and I'm thinking of sending the winning submission a beer =
or two or some other minor token of appreciation.
>

you can boot with a linux live cd, mount the internal drive read only,
plug in an external drive which is at least a big as the internal, dd
the interal drive to an external drive, reboot the target system back
to it's original OS - nothing gets modified on the internal drive -
the only thing logged is the downtime and the reboot - then back in
your office, dd the image again (to preserve the original for court),
and do your forensics on the copy
--=20


------------
wahlstros
------------

-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f