boot mirrored drive...
 
Notifications
Clear all

boot mirrored drive in different computer

7 Posts
5 Users
0 Likes
335 Views
bobby1041
(@bobby1041)
Posts: 20
Eminent Member
Topic starter
 

Can someone give me pointers on how to boot a mirrored drive into a different computer? I am working on a case where I have to mirror a suspect drive then boot the mirrored drive, because there is a proprietary accounting program on it. It is a Win2000 Pro OS.

Thanks in advance.

 
Posted : 05/04/2006 6:57 pm
 nate
(@nate)
Posts: 20
Eminent Member
 

What software are you using to create the image of the suspect hard drive? What are you using for the PC to boot the operating system? Generally, you should stay away from using the suspect hardware if you can. You might want to take a look at using VMware once you have restored the image file to another drive. You could also take a look at using a sparse file/folder copy of the accounting application on a lab system but depending on the application that may not work.

 
Posted : 05/04/2006 7:52 pm
bobby1041
(@bobby1041)
Posts: 20
Eminent Member
Topic starter
 

I used Ghost (-ir) to do the forensic mirror image. I just tried to put the mirrored drive into a lab computer, not the evidence/suspect computer, and boot it up, but that doesn't get past "Starting Windows…"

So, VMWare or Virtual PC will work well in these situations?

Thanks.

 
Posted : 05/04/2006 8:04 pm
 nate
(@nate)
Posts: 20
Eminent Member
 

I have not used Ghost in forensic acquisition mode but I assume that once you acquire the drive you have to use Ghost to restore the image file to another hard drive. As for VMware or Virtual PC, once you have a bootable restore of the suspect disk those applications could adapt for different PC hardware.

 
Posted : 05/04/2006 8:37 pm
(@gmarshall139)
Posts: 378
Reputable Member
 

So, VMWare or Virtual PC will work well in these situations?

I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.

 
Posted : 05/04/2006 9:07 pm
(@olddawg)
Posts: 108
Estimable Member
 

So, VMWare or Virtual PC will work well in these situations?

I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.

Do you mean that its possible to make a bootable dupe of an XP based hard drive only half the time?

 
Posted : 06/04/2006 3:57 am
(@awesomemachine)
Posts: 7
Active Member
 

Use VMWare 5. Yes, it will work. I know people who never use anything but VMWare to boot a suspect drive. When you acquire the image, just write it to a file. Remember what file system the suspect drive is. VMWare has a facility to use an image file as a virtual machine.

 
Posted : 06/04/2006 11:37 am
Share: