Hogfly,
How so? I can't put the Linux version on a CD, put the CD into a live Windows system and use it.
No, one would have to image the drive, or mount it on a Linux system with a write-blocker.
I've seen some tools come out recently (First Response from Mandiant, for one) that require .Net…for no apparent reason. That requirement for Spider really reduces the usefulness of the tool.
I applaud the efforts of the folks who produced the tool, but the requirement for .Net is cumbersome and reduces its usefulness.
Harlan,
I think I misinterpreted your previous post.
The linux version of the tool can run from the bootable side of Helix so you could image a system and run it from there, without using windows and installing .NET.
While .NET is cumbersome, the tool meets its intended use.
*shrug*
You're right, it does…but a 23.1MB download is going to overwrite a lot of sectors, and the installation is going to add Registry keys and perhaps modify files.
Another possibility is run helix from laptop and remotely mount the drive via smb as readonly, noatime. That is provided the drive is setup as shared! Setting the drive up to be shared would be the lesser of the two evils - installing .NET.