Hello,
I need to image a pretty old server running Windows 2003 that has no USB ports and only a CD drive. I could get the disks out but I'd really prefer not to. Unfortunately recent Caine and DEFT versions won't fit in a CD. DEFT 6.1.1 fits but I would prefer something that warns me before mounting drives in write mode (I think the mount warning was added from DEFT 7.0 and above) and I would also prefer something with a recent version of GuyMager or any other tool for acquiring in EnCase E01 format due to the compression.
Any suggestion?
The Belgium Computer Crime Unit got a bootable cd with guymanager, have a look at
The Belgium Computer Crime Unit got a bootable cd with guymanager, have a look at
http//www.lnx4n6.be/
Thanks, I tried the latest version (12.1?) but apparently it doesn't detect the SCSI RAID controller in the server. I tried Helix and it was detected through Adepto wouldn't image the drives so in the end I used DEFT 6.1.1 and imaged everything without ever opening the file browser.
but I would prefer something that warns me before mounting drives in write mode
I used DEFT 6.1.1 and imaged everything without ever opening the file browser.
DEFT 6.1.1 doesn't warn you before mounting NTFS partitions on HDD read-write. It even does this automatically during the boot.
Paladin by Sumuri, Inc. sounds like a possible solution. You can get it here
You can image out to an SMB share across a network; though, imaging speed is only as fast as the network infrastructure. I have tried this with Paladin v5.02 but not Paladin Edge.
Hello,
I need to image a pretty old server running Windows 2003 that has no USB ports and only a CD drive. I could get the disks out but I'd really prefer not to. Unfortunately recent Caine and DEFT versions won't fit in a CD. DEFT 6.1.1 fits but I would prefer something that warns me before mounting drives in write mode (I think the mount warning was added from DEFT 7.0 and above) and I would also prefer something with a recent version of GuyMager or any other tool for acquiring in EnCase E01 format due to the compression.
Any suggestion?
Hi Francesco,
I have a solution using the Guidance Software Knoppix Boot CD (freely available) which you can use to image hard drives (including logical devices through hardware RAID controllers) to a network cable connected hard disk drive (i.e. a WD My Book Live). I've used it often in the same scenario.
PM me your email address and I will be happy to send the PDF walkthrough.
Rgds
Shep
You can use Caine 2.5.1 it fits for cd-rom and it has guymager, mounter gui, smb, etc.
Samuri Paladin Ver 3 will fit on a CD and I have had good success imaging servers with RAID controllers using that.
The latest version of Samuri is a DVD so that's no good for this situation.