I have an Asus eeePC with solid state 'hard drive' to examine.
Has anyone had any success imaging these things?
My first thoughts are to try and boot into something like linen, or helix via an external USB CD drive and aquire via crossover, or similar.
Although I've not attempted that yet through fear of booting into OS.
Any suggestions?
Thanks in advance
pop out the harddrive and image like any other drive thru your write blocker if you're concerned about booting into the os.
pop out the harddrive and image like any other drive thru your write blocker if you're concerned about booting into the os.
This is an eepc with a solid state hard drive. There is no actual 'hard drive' it is just a chip on the board with no i/o connections or data bus readily accessable. So removing the hard drive dosen't come into it.
Hmm, which eee pc? the 1000 model has a hard drive, however you are correct, some of the smaller models (2gig/4gig) use two solid state flash memory chips. For instance, the 701 model has two 1GB HYNIX HY27UG088G5M chips stock.. (serial numbers may vary).
Live options are recommended, you may be able to boot from cdrom/dvdrom, it'll just have to be something that recognizes the flash memory drive.
I was playing around with the Asus eeePC I have at home and just used my F-Response dongle to image it. Now mind you I know this isn't forensically sound because I had it powered on and running. I was more looking at how long it would actually take.
I thought I saw somewhere that Helix can't image the netbook machines because they are so new. It's a driver issue or something. Mind you I could be wrong.
One other idea you could try is if it has a CF card reader, install Backtrack 3 on the SD card and you can boot off of that. At least then you have a linux environment. But I don't remember if BT3 automounts local drives or not.
Tom
Thanks Tom, yes you are always able to boot the machine and start F-Response (any version) to collect your image. While the F-Response connection is completely write blocked, booting the machine is booting the machine, therefore document your actions and you should be fine.
We've had to do this in some cases (See this Apple Airbook case from late last year).
http//
-Matt
pop out the harddrive and image like any other drive thru your write blocker if you're concerned about booting into the os.
This is an eepc with a solid state hard drive. There is no actual 'hard drive' it is just a chip on the board with no i/o connections or data bus readily accessable. So removing the hard drive dosen't come into it.
sorry Colin - I had my hands on a couple of the eee pc's that i was configuring for mates - both of which had hard drive - my bad!
I have not run into an eepc yet but I have a version of Helix3 2008R1 on a USB drive that allows me to boot these small notebooks into linux. It works fairly well but is a bit flaky at times getting the Target drive to go RW.
I have successfully imaged one via USB using an encase boot CD, I had the same fear with booting the O/S so I attached a USB floppy drive too so that in the event I missed the boot menu or it failed to start from CD it default to the floppy drive anyway which also had an encase disk so all I had to do was start again but fortunately it work first time.
Not sure if yours is same model but with mine I found it contained to solid state drive so I had to repeat the process for each one. If I remember right one was 4GB and the other 16GB.
by Encase boot CD you mean some Helix with Linen ?