±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36595
New Yesterday: 0 Visitors: 106

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

HELP!!

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

pizzmor
Member
 

HELP!!

Post Posted: May 25, 11 20:54

OK, here is my problem.

I am using Windows 7 Enterprise 64bit, FTK 3.3, and Imager V.3.01. I am tasked with checking certain internet files over our network, by logging in with admin rights, launching FTK, adding remote data, mounting the c: drive of the target machine and taking a look see with Imager.

Now, I had been doing this for months until my machine took a dump...ram/motherboard issue, so I grabbed the same exact computer from a co worker and rebuilt the OS on a clean 1BG WD hard drive.

I reinstalled the FTK suite and began my operation again. All looked well until I went to Imager to look at the mounted drive and it wasn't listed. However, the mounted drive shows up under "my computer" as a removable disc and I can do nothing else with the files that I can see listed....this is where I am lost.

I called Access Data and they were of no help. They haven't seen this before. I have exhausted a few other leads, but to no avail. I was hoping the pool of members here could lend a hand.

Thanks in advance for any help no matter which way this goes. Very Happy Very Happy  
 
  

BitHead
Senior Member
 

Re: HELP!!

Post Posted: May 25, 11 22:46

Were you using iSCSI previously to connect to the remote machine?  
 
  

pizzmor
Member
 

Re: HELP!!

Post Posted: May 25, 11 22:59

Dude I have no idea. I am a bit more heavily weighted on the investigator/agent side than I am on the forensic side I hate to say...but I am learning.

I spoke to my IT buddy and he seemed to think it was an FTK issue and not a Windows 7 issue, but I am not sure. Going on three days now trying to fix this.... Sad  
 
  

keydet89
Senior Member
 

Re: HELP!!

Post Posted: May 25, 11 23:07

iSCSI installs by default on Windows 7, and it doesn't appear from the original process that F-Response was used. Rather, it appears to be mapping a share or something similar.

Pizzmor, could you walk through your process exactly? For example, in the original post, you mention logging in via Admin rights...how did you do this? RDP? "net use", mapping a share?

This might help folks see what you did and suggest things you may be able to do to troubleshoot and resolve this issue.  
 
  

pizzmor
Member
 

Re: HELP!!

Post Posted: May 25, 11 23:13

Our IT supervisor gave us/me a login and password that I use to log into the network and conduct my searches. I had nothing to do with the process in setting that up. I use the credentials when I am adding remote evidence within FTK...I hope that helps.  
 
  

douglasbrush
Senior Member
 

Re: HELP!!

Post Posted: May 25, 11 23:14

Log in how though? What program is being used - there an icon you go through?  
 
  

pizzmor
Member
 

Re: HELP!!

Post Posted: May 25, 11 23:22

Well when I access the network I just login via the default windows login. I am mapping a share via FTK.  
 

Page 1 of 2
Page 1, 2  Next