Hello everyone,
a new challenge, today I came across a Samsung Tablet xe500t1c that has windows 8.1 installed, I was thinking of different methods of imaging it, the most common one is to connect a USB CD drive and boot a live forensic CD, however to do that I need to change boot order.
One I am in the bios/UEFI settings there are only two tabs (SysInfo and Security) there is not boot option or boot order tab. I have disabled secure boot and yet still no options to change the boot order.
If anyone has a different way to image this device, please share.
I know its not supported in all the mobile forensics suites, because most probably its considered to be a computer.
Ideas?
Thanks
Maybe you found it yourself, but this is the suggestions on the tabletpcreview forum. It isnt the forensic way and idk if you can access Windows.
You can always get to the Troubleshoot Startup (for example go to power settings, and while press restart hold the shift key), anyway you have to get Command Prompt option (from "that menu" Troubleshoot>Advanced Options>Command Prompt). <– Make sure you already have the bootable-USB placed.
After command prompt is launched, you trype D or E to get to your USB and verify you're there using dir after each attempt. When you see the list with your copied-windows-files, you aim for "setup.exe" and execute it from there.
If that tablet is encrypted (with BitLocker), you'll need to obtain a BitLocker Recovery Key from the user's Microsoft Account. There is a good whitepaper on the subject http//
