I had to acquire a strange pc. It's a ASUS and you can unplug the keyboard. There's no name or others except the serial and "12M". How is possible to image it?
EDIT SOMETHING LIKE THIS http//
thanks and bestregards
Depending on the version, the UEFI settings will allow you to boot from external device.
I believe the options are under Settings >> Change PC Settings >> Update and recovery, but I do not have the device front of me.
The internal HD is an inbuilt flash memory. So the best way would be as jhup said, boot from an external device. I used a WinPE environment with FTK imager added onto it to image a similar device.
So I had to SWITCH ON the pc, change the settings and boot using a live USB as winPE. It's not forensically sound…
Other chances?
So I had to SWITCH ON the pc, change the settings and boot using a live USB as winPE. It's not forensically sound…
Why? ?
Other chances?
Sure, you open up the tablet, find out what kind of bus interface the internal mass storage device has (I believe ? that those devices use an eMMC, thus it is a BGA chip), desolder it, re-solder it to a connector (that you may need to design yourself) then you use (if needed) a converter through your write blocker to access it. 😯
Maybe more "sound" forensically, but surely more things may go wrong in the procedure.
In any case if you are going the "easier" way you shouldn't use "a WinPE", but rather specifically "a WinFE", i.e. a special form of Windows PE that avoids the logical mounting of the internal hard disk…
http//
http//
http//
jaclaz
OK great!
I'm guessing you don't have Spektor? Or if you do use that. The Asus is an Intel so you shouldn't have any problems with Spektor. Worst case a LIVE Encase capture. Document your process and rational. Lots of options. WinFE is probably your cheapest and best option.