Network-based imaging tools?

FTK3 can do it, however if you do not have FTK3, for the size of your network I would say one of the versions of F-Response paired with your current tools.

The DD utility that comes with the FAU (http//www.gmgsystemsinc.com/fau/) let's you write output to a socked

dd.exe -v if=\\.\PhysicalDrive0 of=192.168.0.15 –iport 3000

And it is free.

You could always use DD and netcat too.

thanks for suggestions, do these tools have any limitatioons?!!!

what are existing suitable tools for imaging a disk over a network?which one is the most suitable for a small network( 1 server and 3 hosts)?

Suitable …

What will such the imaging disrupt? Is it OK (i.e. no harm done), is it acceptable, or is it unacceptable for such disruption? (This depends on some familiarity with imaging solutions.) For example, if the server does network backup, and it's already going for close to 24 hours a day, it may not be a good idea to add more traffic to the network if the backups are business critical.

If you can only use part of the bandwith, does your prospective solution allow you to choke the imaging traffic to that level? or does it assume it can use as much as it can grab?

Are there any other restrictions involved?

And what requirements come in from the imaging point of view? Do you have to get the image done in a certain time? On a certain date? Do you need to get it done in a certain image format? Do you have imaging software runs on the target system involved? Is it a temporary go in-go out imaging, or will it be an in-place solution. Can it be resumed in case of a temporary network interruption? Is there any information security requirements involved – do you have to encrypt the data because it is passing over an untrusted network? Etc, etc.

There are all kinds of technical solutions … but suitabilityis based on other considerations those of the IT environment, and those of the process in which the imaging to be done. Weighing them together is best done by people who know those aspects well.

But perhaps you weren't using the work in the way I have interpreted it. In that case I perhaps should add a suggestion to check up on the network imaging solutions from F-response.