[2] IMHO even more relevant from an ethical/educational point of view is that IF Doe bid for the project  AND he needs suggestions on how to do the very basic first steps of what he bid for (and won) THEN he is an impostor (and NOT a Digital Forensics Examiner)
Â
I couldn't have said it better myself.
Sure, and that is where "forensic sound" boot disks (please read as CD/DVD and/or USB sticks) come handy.
This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.
Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.
How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?
This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.
Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.
How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?
Well, that is why I talked also of USB, if the computer cannot boot from USB, it would be a strange today computer, but  - out of curiosity - how EXACTLY do you plan to run WinAcq or LinEn?
A crossover cable connected on one end to the computer and the other hand to what?
jaclaz
Sure, and that is where "forensic sound" boot disks (please read as CD/DVD and/or USB sticks) come handy.
This option was considered as well. We have done this on several mock scenes, but that's only after the Boot Sequence of the computer was change to HDD last.
Most computers today will check the HDD first for a bootable partition, since CD/DVD Drive are no longer standard peripheral device.
How realistic it is do a 500GB acquisition if Tesh use a crossover cable + EnCase WinAcq or LinEn (or some other tool), how many hours would it take?
If you're on a gigabit NIC at both ends then it'll probably only limit the drive a bit (bearing in mind a 500gb drive, assuming you're not talking an SSD, is probably not particularly modern or high-speed).
Please do Doe a favor and suggest they hire a subcontractor in Canada to do the forensic collection. Both parties will be better off.
Please do Doe a favor and suggest they hire a subcontractor in Canada to do the forensic collection. Both parties will be better off.
Well, said.
The list of expenses is growing.
Till now Tesh was spending:
1) an undisclosed amount of money for Doe's services
2) some 2-10 US$ for a CD/DVD or USB stick
3) some 80-120 US$ for an external USB disk
Hence I asked about what is supposed to be on the other end of the crossover cable, if - at it should be - it is a (forensic) laptop we have to add:
4) some 2-5 US$ for a crossover cable [1]
5) some 500-2000 US$ for a laptopÂ
jaclaz
[1] since we are talking of GB lan, AFAIK they are all auto-switch so a normal lan cable should do instead of the cross-over one.
Â