±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36738
New Yesterday: 0 Visitors: 135

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

boot mirrored drive in different computer

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

bobby1041
Member
 

boot mirrored drive in different computer

Post Posted: Apr 05, 06 18:57

Can someone give me pointers on how to boot a mirrored drive into a different computer? I am working on a case where I have to mirror a suspect drive then boot the mirrored drive, because there is a proprietary accounting program on it. It is a Win2000 Pro OS.

Thanks in advance.  
 
  

nate
Member
 

Re: boot mirrored drive in different computer

Post Posted: Apr 05, 06 19:52

What software are you using to create the image of the suspect hard drive? What are you using for the PC to boot the operating system? Generally, you should stay away from using the suspect hardware if you can. You might want to take a look at using VMware once you have restored the image file to another drive. You could also take a look at using a sparse file/folder copy of the accounting application on a lab system but depending on the application that may not work.  
 
  

bobby1041
Member
 

Re: boot mirrored drive in different computer

Post Posted: Apr 05, 06 20:04

I used Ghost (-ir) to do the forensic mirror image. I just tried to put the mirrored drive into a lab computer, not the evidence/suspect computer, and boot it up, but that doesn't get past "Starting Windows..."

So, VMWare or Virtual PC will work well in these situations?

Thanks.  
 
  

nate
Member
 

Re: boot mirrored drive in different computer

Post Posted: Apr 05, 06 20:37

I have not used Ghost in forensic acquisition mode but I assume that once you acquire the drive you have to use Ghost to restore the image file to another hard drive. As for VMware or Virtual PC, once you have a bootable restore of the suspect disk those applications could adapt for different PC hardware.  
 
  

gmarshall139
Senior Member
 

Re: boot mirrored drive in different computer

Post Posted: Apr 05, 06 21:07

- bobby1041
So, VMWare or Virtual PC will work well in these situations?


I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.
_________________
Greg Marshall, EnCE 
 
  

OldDawg
Senior Member
 

Re: boot mirrored drive in different computer

Post Posted: Apr 06, 06 03:57

- gmarshall139
- bobby1041
So, VMWare or Virtual PC will work well in these situations?


I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.


Do you mean that its possible to make a bootable dupe of an XP based hard drive only half the time?  
 
  

AwesomeMachine
Newbie
 

Re: boot mirrored drive in different computer

Post Posted: Apr 06, 06 11:37

Use VMWare 5. Yes, it will work. I know people who never use anything but VMWare to boot a suspect drive. When you acquire the image, just write it to a file. Remember what file system the suspect drive is. VMWare has a facility to use an image file as a virtual machine.
_________________
Those who exalt human intellect are laughing stock for The Sons of God. 
 

Page 1 of 1