Image laptop through Boot CD + USB

Ok thanks, would be nice if this computer had supported booting through CD or USB, but problems help me know the solution for something in the future.

Was it $49 for the USB?

What boot package is everyone using from a USB…? .

I like Raptor from Forward Discovery…

No, I use the free ISO and unetbootin to create my own bootable usb. Work's like a charm.

Was it $49 for the USB?

What boot package is everyone using from a USB…? .

I like Raptor from Forward Discovery…

What's the make and model of the laptop?
There may be a Boot Menu key you can press during bootup to give you a list of devices you can boot from.

If you want to try the USB route, get UNetBootIn (from Sourceforge) and create a bootable USB with your favorite linux ISO (SPADA, Paladin, Raptor) and boot to it. (USB must be FAT32 - or else it will not work).

Good luck!
-=Art=-

Drilling
Always an option, but agree it would need to be done carefully. If you document clearly (photos!) that fact that the screws were stripped on arrival, then it would be quite reasonable that you drilled them out in order to obtain the best forensic image possible of the computer.

An option to review
http//www.amazon.com/Alden-4507P-Grabit-Broken-Extractor/dp/B000Q60UOO/ref=pd_cp_hi_3

That type of extractor works pretty well, but note I'm not recommending the above link, just providing as an option. (I've drilled out screws on laptops, but can't remember the brand I have at work.)

Another suggestion would be to PRACTICE with the tool. get something unimportant, and extract a couple of screws (preferably of the same size or close to as the actual evidence item). for added realism, strip the screws first.

Is there a PXE boot option? If you set up a PXE boot server going, you can boot into a small linux shell and image via USB (maybe), or image over the network.

Thank you for your message Saladin, but it is not an option here as I have stated before.

@Patrick I know that you think there is no reason why a reasonable person wouldn't allow it, but there are several reasonable people here on both sides and there is a chance that something could go wrong with drilling or any attempts like that, and no one wants to take that chance.
Which I totally understand when there are options like Mike suggested and look for option like twjolson. I appreciate the msg Patrick, but I would hope that you can see even if its a small chance it's a chance that something bad can happen.

The computer is a perfectly good working computer and has usb ports, firewire ports, NO PCMCIA card, Ether port.

Any other suggestions

Drilling
Always an option, but agree it would need to be done carefully. If you document clearly (photos!) that fact that the screws were stripped on arrival, then it would be quite reasonable that you drilled them out in order to obtain the best forensic image possible of the computer.

An option to review
http//www.amazon.com/Alden-4507P-Grabit-Broken-Extractor/dp/B000Q60UOO/ref=pd_cp_hi_3

That type of extractor works pretty well, but note I'm not recommending the above link, just providing as an option. (I've drilled out screws on laptops, but can't remember the brand I have at work.)

Another suggestion would be to PRACTICE with the tool. get something unimportant, and extract a couple of screws (preferably of the same size or close to as the actual evidence item). for added realism, strip the screws first.

Digintel,
Let's also say that if this were you that you would fight any and all efforts above the basic image including flashing and drilling. You would go to the court and play this out to potentially be abusive and destructive.

So would you use FTK imager lite on a thumb drive?

If there was no other way, yes.
As long as I can explain what I did & why, and what impact it will have on the results. Make sure the client understands the impact, as well.
And I would document like a maniac of course.

Roland

Add a USB floppy drive. Create a floppy disk that will allow booting from CD, bypassing the Bios, (I know this can be done, but I don't know details right now. Boot to Live CD and image.

This may work, if the system will read the floppy drive. That part I am unsure on. Test on a similar system first.

You can use helix and do a live capture as well

I mentioned before about using a floppy drive to boot from a USB drive.

Here is the link I saw sometime ago.

http//www.howtogeek.com/howto/16822/boot-from-a-usb-drive-even-if-your-bios-wont-let-you/