zoukankan      html  css  js  c++  java
  • Another option to bootup evidence files

    When it comes to booting up evidence files acquired from target disk, you got two options. One is VFC and the other is Live View. Both of them could create snapshots out of images such as EWF(E01). So forensic examiners could conduct a live forensic as if suspect's computer/laptop is in front of them.

    Some may ask if there is another option to bootup evidence files. And the answer is "yes". I will show you the combination of FTK Imager and Oracle VirtualBox. First we have to mount evidence files with Admin privileges.

     Now we know these evidence files mounted as "PhysicalDrive1". So we have to create vmdk out of this physical drive. Look! It also requires Admin Privileges to run this command prompt.

    If everything is fine and the result shows that we successfully create vmdk files from PhysicalDrive1.

    Next we have to create a Virtual Machine by choosing the existing vmdk files we created as above.

    Finally we could bootup suspect's computer/laptop and conduct a live forensics.

  • 相关阅读:
    hdu 1225大水题
    hdu2102广搜
    hdu1403 赤裸裸的后缀数组
    hdu 1526 poj 1087最大流
    hdu 1557暴力枚举
    hdu 1240广搜
    hdu4416 后缀数组
    hdu1113大水题
    hdu2222赤裸裸的DFA
    hdu4476水题
  • 原文地址:https://www.cnblogs.com/pieces0310/p/9119286.html
Copyright © 2011-2022 走看看