Live linux CD (not ...
 
Notifications
Clear all

Live linux CD (not DVD) for network imaging

8 Posts
7 Users
0 Likes
888 Views
(@francesco)
Posts: 79
Trusted Member
Topic starter
 

Hello,

I need to image a pretty old server running Windows 2003 that has no USB ports and only a CD drive. I could get the disks out but I'd really prefer not to. Unfortunately recent Caine and DEFT versions won't fit in a CD. DEFT 6.1.1 fits but I would prefer something that warns me before mounting drives in write mode (I think the mount warning was added from DEFT 7.0 and above) and I would also prefer something with a recent version of GuyMager or any other tool for acquiring in EnCase E01 format due to the compression.

Any suggestion?

 
Posted : 23/09/2014 1:33 pm
(@kbertens)
Posts: 88
Trusted Member
 

The Belgium Computer Crime Unit got a bootable cd with guymanager, have a look at
http//www.lnx4n6.be/

 
Posted : 23/09/2014 4:16 pm
(@francesco)
Posts: 79
Trusted Member
Topic starter
 

The Belgium Computer Crime Unit got a bootable cd with guymanager, have a look at
http//www.lnx4n6.be/

Thanks, I tried the latest version (12.1?) but apparently it doesn't detect the SCSI RAID controller in the server. I tried Helix and it was detected through Adepto wouldn't image the drives so in the end I used DEFT 6.1.1 and imaged everything without ever opening the file browser.

 
Posted : 24/09/2014 5:12 pm
(@thefuf)
Posts: 262
Reputable Member
 

but I would prefer something that warns me before mounting drives in write mode

I used DEFT 6.1.1 and imaged everything without ever opening the file browser.

DEFT 6.1.1 doesn't warn you before mounting NTFS partitions on HDD read-write. It even does this automatically during the boot.

 
Posted : 24/09/2014 11:40 pm
(@davepawlak)
Posts: 29
Eminent Member
 

Paladin by Sumuri, Inc. sounds like a possible solution. You can get it here www.sumuri.com. Paladin v5.02 includes the Paladin Toolkit for advanced forensic needs; while, the new release Paladin Edge is strictly a lightweight imaging utility.

You can image out to an SMB share across a network; though, imaging speed is only as fast as the network infrastructure. I have tried this with Paladin v5.02 but not Paladin Edge.

 
Posted : 25/09/2014 10:38 am
(@shep47)
Posts: 51
Trusted Member
 

Hello,

I need to image a pretty old server running Windows 2003 that has no USB ports and only a CD drive. I could get the disks out but I'd really prefer not to. Unfortunately recent Caine and DEFT versions won't fit in a CD. DEFT 6.1.1 fits but I would prefer something that warns me before mounting drives in write mode (I think the mount warning was added from DEFT 7.0 and above) and I would also prefer something with a recent version of GuyMager or any other tool for acquiring in EnCase E01 format due to the compression.

Any suggestion?

Hi Francesco,

I have a solution using the Guidance Software Knoppix Boot CD (freely available) which you can use to image hard drives (including logical devices through hardware RAID controllers) to a network cable connected hard disk drive (i.e. a WD My Book Live). I've used it often in the same scenario.

PM me your email address and I will be happy to send the PDF walkthrough.

Rgds

Shep

 
Posted : 27/09/2014 12:10 am
nannib
(@nannib)
Posts: 13
Active Member
 

You can use Caine 2.5.1 it fits for cd-rom and it has guymager, mounter gui, smb, etc.

 
Posted : 28/09/2014 11:18 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Samuri Paladin Ver 3 will fit on a CD and I have had good success imaging servers with RAID controllers using that.

The latest version of Samuri is a DVD so that's no good for this situation.

 
Posted : 30/09/2014 6:07 am
Share: