Symantec Ghost was not presented as a means of getting a forensic
duplicate. As stated in my first response, the Ghost image is to
be added to the new drive and that drive is placed in the suspect
desktop so that it can be placed back into production. That would
leave the suspect drive available for any type of forensic
investigation, whether it is done internally or sent out to another
company. I normally do not want to leave a user without a desktop
just because I need to investigate something. Since this is a
case of data deletion/recovery and not an investigation of suspected
torjan/rootkit, getting the system back into production using a Ghosted
drive is (in my opinion) a business-practical course of action.<br>
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------<br>
Ghost will not give you a forensically sound image. Unless something<br>
changes recently, Ghost won't image unallocated space, so you won't be able<br>
to recover any deleted files. I'd recommend using the Helix Live CD at<br>
<a href="http://www.e-fense.com/helix/">http://www.e-fense.com/helix/</a>, which based on Knoppix, but will never automatically mount any disks found, as Knoppix will.<br>
<br>
It contains all the tools previously mentioned - dcfldd for imaging, which<br>
you can pipe to netcat to create an image over the network. The Sleuthkit<br>
for analysis, which is basically just a front-end to other tools also<br>
included. However, the learning curve can bit a bit steep.<br>
<br>
-----Original Message-----<br>
From: Red Leg [mailto:<a href="mailto:redleg18@gmail.com">redleg18@gmail.com</a>]<br>
Sent: Sunday, September 11, 2005 8:37 PM<br>
To: <a href="mailto:full-disclosure@lists.grok.org.uk">full-disclosure@lists.grok.org.uk</a><br>
Subject: Re: [Full-disclosure] Forensic help?<br>
<br>
<br>
On 9/11/05 6:33 PM, "Red Leg" <<a href="mailto:redleg18@gmail.com">redleg18@gmail.com</a>> wrote:<br>
<br>
> Hi all.<br>
> <br>
> I was wondering if anyone knows of a program/system that I can <br>
> purchase,<br>
as<br>
> a private individual, that will allow me to<br>
> <br>
> 1) mirror a hard drive on location and<br>
> <br>
> 2) take that mirror and restore it to another drive. And<br>
> <br>
> 3) Find any CONVENTIONALLY erased files?<br>
> <br>
> -- This would be either a Windows NTFS or FAT32 drive.<br>
<br>
<br>
Wow!<br>
<br>
Thanks all. I really appreciate the education!<br>
<br>
I wish that I could keep the target drive, and change it out. However,
this is a Freedom of Information Act issue. I don't think they'll let
me keep the original/target.<br>
<br>
<br>
I knew about Drive Image, but I didn't know it or Symantec Ghost would
be able to get the erased data (as in using the "Delete Key" or right
click delete).<br>
<br>
Thanks!<br>
Redleg18<br>
<br>
<br>
_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a><br>
<br>
-------------------------------------------------------------------------------<br>
This message and any included attachments are from Siemens Medical
Solutions USA, Inc. and are intended only for the addressee(s). <br>
The information contained herein may include trade secrets or
privileged or otherwise confidential information. Unauthorized
review, forwarding, printing, copying, distributing, or using such
information is strictly prohibited and may be unlawful. If you
received this message in error, or have reason to believe you are not
authorized to receive it, please promptly delete this message and
notify the sender by e-mail with a copy to
<a href="mailto:Central.SecurityOffice@shs.siemens.com">Central.SecurityOffice@shs.siemens.com</a> <br>
<br>
Thank you<br>
_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/">http://secunia.com/</a><br>
<br>