Here are 2 sceniaros,
Scenario 1 An incident occured and an entire imaging process is needed to be applied on a live "Windows" sever without the move of restarting or switching off the windows. - The target would be a massive capacity hard-drive which will be connected to the server
Scenario 2 An incident occured and an entire RAID imaging process is needed to be applied on a live "Linux" sever without the move of restarting or switching off the windows. - The target would be a massive capacity hard-drive which will be connected to the server
What software is to be used? or hardware..?
I know you can use live CD's to do imagine then import them into FTK, but in this case the servers are not to be switched off.
Thanks,
I've done scenario 1 using FTK imager.
EDIT FTK Imager Lite on a USB attached hard drive. I should have been clearer.
Great work, so a question regarding scenario one, you've got a document that will tell you all the important logs and thier locationson all windows versions? like a list of locations of all logs in all versions of windows?
Anyone shares his/her experiencein scenario 2?
Thanks again .
DD could be a starting point
I have done both. F-Response on either scenario then use your tool of choice on your capture/exam machine.
another vote for F-Response. it just works
EnCase v7.06 Direct Network Connection?
You can create servlets for Windows (32 and 64 bit), Mac OS's, Linux and more.
Those who've used FTK, i agree its simple and just does the job, but in linux its a little bit different specially when i want live acquisition.
So those who voted for F-Response and Encase perhaps a little bit of how-to-do's?..
Cheers.
EnCase - create servlet on examiner machine, install/run it on target machine(s), use 'Add Network Preview' function in EnCase to connect to target machine - then browse file systems, acquire data etc as per normal.
Evidence Processor has a Snapshot function that can be used to collect volatile data such as open ports, network connections, open files, logged on users, etc etc
easiest way to see f-response in action is to watch the videos on their site, f-response.com