zoukankan      html  css  js  c++  java
  • Another option to bootup evidence files

    When it comes to booting up evidence files acquired from target disk, you got two options. One is VFC and the other is Live View. Both of them could create snapshots out of images such as EWF(E01). So forensic examiners could conduct a live forensic as if suspect's computer/laptop is in front of them.

    Some may ask if there is another option to bootup evidence files. And the answer is "yes". I will show you the combination of FTK Imager and Oracle VirtualBox. First we have to mount evidence files with Admin privileges.

     Now we know these evidence files mounted as "PhysicalDrive1". So we have to create vmdk out of this physical drive. Look! It also requires Admin Privileges to run this command prompt.

    If everything is fine and the result shows that we successfully create vmdk files from PhysicalDrive1.

    Next we have to create a Virtual Machine by choosing the existing vmdk files we created as above.

    Finally we could bootup suspect's computer/laptop and conduct a live forensics.

  • 相关阅读:
    Codeigniter 控制器的继承问题
    laravel 安装
    js preventDefault() 方法
    jquery 获取$("#id").text()里面的值 需要进行去空格去换行符操作
    HDU_1394_线段树
    Codeforces_723_D
    Codeforces_723_C
    Codeforces_723_B
    Codeforces_723_A
    HDU_4456_二维树状数组
  • 原文地址:https://www.cnblogs.com/pieces0310/p/9119286.html
Copyright © 2011-2022 走看看