Re: P2V - Live Forensics

Today the are different ways to work with forensics tools, I will give a =
option that you can work very comfortable, watching the HD like a real =
situation.

1 - Create a image DD using Linux
2 - Generate MD5 AND SHA1 Hash
3 - Get Virtual Box from Oracle (FREE)
4 - Install in your favorite SO (Windows Linux, Mac)
5 - Convert DD to DVI
6 - Open the virtual Box and create a VM using this DVI
7 - Boot the VM and you will have a clone of the original machine.


Paulo Breim


On 17/02/2011, at 20:52, Bahrs, Art wrote:
>=20
>=20
> -----Original Message-----
> From: [email protected] =
[mailto:[email protected]] On Behalf Of [email protected]
> Sent: Tuesday, February 15, 2011 7:14 AM
> To: [email protected]
> Subject: P2V - Live Forensics
>=20
> Ladies, Gentlemen, and otherwise:
>=20
> I have a situation whereby I need to obtain an image of an =
individual's laptop suitable for potential prosecution in a US court; =
however, I only have a limited window in which to grab the image, and =
was looking for alternatives in order to not "spook" the poor guy or his =
co-workers who would no doubt tell him about me, as I go into his office =
and randomly image his drive!
>=20
>=20
> I thought about using P2V (Physical to Virtual), but realize that such =
software does make some steps to alter the system and thus may have =
court challenges. Is there possibility such could be explained in court, =
or perhaps md5 hash of his files(not the disk image) taken while online =
and then compared to a virtual image of sorts.
>=20
> Please advise, and I'm thinking of sending the winning submission a =
beer or two or some other minor token of appreciation.
>=20
>=20
>=20
>=20
> -----------------------------------------------------------------
> Certify Software Integrity - thawte Code Signing Certificates
> This guide will show you how Code Signing Certificates are used to =
secure code that can be downloaded from the Internet. You will also =
learn how these certificates operate with different software platforms.
> =
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872=
ea1f
>=20
>=20
>=20
>=20
> This message is intended for the sole use of the addressee, and may =
contain information that is privileged, confidential and exempt from =
disclosure under applicable law. If you are not the addressee you are =
hereby notified that you may not use, copy, disclose, or distribute to =
anyone the message or any information contained in the message. If you =
have received this message in error, please immediately advise the =
sender by reply email and delete this message.
>=20
>=20
> -----------------------------------------------------------------
> Certify Software Integrity - thawte Code Signing Certificates
> This guide will show you how Code Signing Certificates are used to =
secure code that can be downloaded from the Internet. You will also =
learn how these certificates operate with different software platforms.
> =
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872=
ea1f
>=20
>=20


-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f