RE: P2V - Live Forensics

I have used EnCase for many years and have just looked at using EnCase Ente=
rprise. This was very expensive in the past but the price has recently been=
 reduced to $10,000.

If you have the budget, I would suggest looking at this.

Brian Hitchen MBCS
Information Security Manager
esure
IT





-----Original Message-----
From: [email protected] [mailto:[email protected]] On=
 Behalf Of [email protected]
Sent: 15 February 2011 15:14
To: [email protected]
Subject: P2V - Live Forensics

Ladies, Gentlemen, and otherwise:

I have a situation whereby I need to obtain an image of an individual's lap=
top suitable for potential prosecution in a US court; however, I only have =
a limited window in which to grab the image, and was looking for alternativ=
es in order to not "spook" the poor guy or his co-workers who would no doub=
t tell him about me, as I go into his office and randomly image his drive!


I thought about using P2V (Physical to Virtual), but realize that such soft=
ware does make some steps to alter the system and thus may have court chall=
enges. Is there possibility such could be explained in court, or perhaps md=
5 hash of his files(not the disk image) taken while online and then compare=
d to a virtual image of sorts.

Please advise, and I'm thinking of sending the winning submission a beer or=
 two or some other minor token of appreciation.




-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure c=
ode that can be downloaded from the Internet. You will also learn how these=
 certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872e=
a1f



............................ esure(r) .................................

( car insurance | home insurance | travel insurance | pet insurance )

........................ www.esure.com ..............................

This email may contain confidential or legally privileged information
intended only for the individual or entity named in the email address.
If you are not the intended recipient, any disclosure, copying,
distribution or reliance upon its contents is strictly prohibited.
The content of this email does not necessarily reflect the views of
the company or its officers and esure takes no responsibility for the
views of the author.  If you have received this email in error,
please reply to the sender so esure can arrange for its proper
delivery, then delete it and all copies from your system. Although
esure aims to use efficient virus checking procedures, we accept no
liability for viruses. Recipients should use their own up-to-date
virus prevention. Emails sent and received may be read by people
other than the intended recipient and may be monitored to ensure
efficient email systems.

esure Services Limited, Registered in England and Wales No. 2135610.
Registered Office: The Observatory, Reigate, Surrey RH2 0SG.
Authorised and regulated by the Financial Services Authority

....................................................................

-----------------------------------------------------------------
Certify Software Integrity - thawte Code Signing Certificates
This guide will show you how Code Signing Certificates are used to secure code that can be downloaded from the Internet. You will also learn how these certificates operate with different software platforms.
http://www.dinclinx.com/Redirect.aspx?36;5000;25;1371;0;2;946;005be7f5c872ea1f