Join Us!

boot mirrored drive...
 
Notifications
Clear all

boot mirrored drive in different computer  

  RSS
bobby1041
(@bobby1041)
New Member

Can someone give me pointers on how to boot a mirrored drive into a different computer? I am working on a case where I have to mirror a suspect drive then boot the mirrored drive, because there is a proprietary accounting program on it. It is a Win2000 Pro OS.

Thanks in advance.

Quote
Posted : 05/04/2006 7:57 pm
nate
 nate
(@nate)
New Member

What software are you using to create the image of the suspect hard drive? What are you using for the PC to boot the operating system? Generally, you should stay away from using the suspect hardware if you can. You might want to take a look at using VMware once you have restored the image file to another drive. You could also take a look at using a sparse file/folder copy of the accounting application on a lab system but depending on the application that may not work.

ReplyQuote
Posted : 05/04/2006 8:52 pm
bobby1041
(@bobby1041)
New Member

I used Ghost (-ir) to do the forensic mirror image. I just tried to put the mirrored drive into a lab computer, not the evidence/suspect computer, and boot it up, but that doesn't get past "Starting Windows…"

So, VMWare or Virtual PC will work well in these situations?

Thanks.

ReplyQuote
Posted : 05/04/2006 9:04 pm
nate
 nate
(@nate)
New Member

I have not used Ghost in forensic acquisition mode but I assume that once you acquire the drive you have to use Ghost to restore the image file to another hard drive. As for VMware or Virtual PC, once you have a bootable restore of the suspect disk those applications could adapt for different PC hardware.

ReplyQuote
Posted : 05/04/2006 9:37 pm
gmarshall139
(@gmarshall139)
Active Member

So, VMWare or Virtual PC will work well in these situations?

I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.

ReplyQuote
Posted : 05/04/2006 10:07 pm
OldDawg
(@olddawg)
Active Member

So, VMWare or Virtual PC will work well in these situations?

I suppose the best response to that question is that it works well when it works. I think the average success rate with an XP system is around 50%. You should have better odds with 2000.

Do you mean that its possible to make a bootable dupe of an XP based hard drive only half the time?

ReplyQuote
Posted : 06/04/2006 4:57 am
AwesomeMachine
(@awesomemachine)
New Member

Use VMWare 5. Yes, it will work. I know people who never use anything but VMWare to boot a suspect drive. When you acquire the image, just write it to a file. Remember what file system the suspect drive is. VMWare has a facility to use an image file as a virtual machine.

ReplyQuote
Posted : 06/04/2006 12:37 pm
Share: