Windows Workflow vs Linux Workflow

am looking to compare Windows workflow vs Linux workflow, both against a Windows target.

Workflow for WHAT exactly?

Post an example of what you mean for "workflow" (either the "Windows" or the "Linux" one with which you are familiar).

I mean, whatever the scope is, the "theoretical" workflow remains the same, tools used or "practical workflow" may differ.

jaclaz

hi all

i have a case where in the hard disk is protected with the password. i wanted to image it using forensic dossier, it says the hard disk is locked, unlock to continue. if i connect to the system, it shows the disk, but, the disk will not mount in windows environment. i tried to clone, using cain but it is not proceeding further showing lots of bad sectors and the time is indefinite. any solutions for by passing the pw and protecting the integrity of the disk and image the same for further analysis. thank u.

by workflow, i refer to the steps one would take to acquire, verify and interrogate a disk image for evidence of some incident/crime. Hope this clears it up.

by workflow, i refer to the steps one would take to acquire, verify and interrogate a disk image for evidence of some incident/crime. Hope this clears it up.

The steps to acquire and verify a single HDD are the same no matter the OS. As far as "interrogating", there are whole books (and more books) written on the subject. And depending on the incident/crime what an examiner would look for is quite different.

If an examiner were looking for evidence of theft of trade secrets the items of interest are likely to be quite different than what an examiner would look for on the computer of a subject suspected of trying to cover up a murder-for-hire plot. Sure both may include looking at communications, however the differences are far greater than the similarities in what would likely be substantive.

The steps needed for acquisition are about the same for Windows and Linux, it is usually more of a matter of if you prefer opens source or paid support. The actual count of steps required is more based on programs rather than OS. Lastly, different interrogation tools may make faster acquisition/inquisition faster or more detailed, depending on how the product works and what you want. Think how few steps dd is, but also how it is only limited to acquisition and not interrogation. All a matter of personal preference rather than efficiency, thought some actions are a bit faster on one os than another, but that is due to program, not OS.

… it is usually more of a matter of if you prefer opens source or paid support.

To be picky (as I actually am) there are also cases of "paid, no support" 😯

jaclaz

To be picky (as I actually am) there are also cases of "paid, no support" 😯

jaclaz

It's at times like this we need a 'Like' button.

Thanks to everyone for their response so far. If I can clarify a bit more as to what I am trying to achieve here.

I am looking to consider the workflow or procedure if you like of a Windows based examination of Windows machine which will include from acquisition to reporting including the steps taken and tools used. I then have to devise a similar workflow for using a Linux distro (any one) to conduct the same examination. I then want to compare the two workflows and consider the pros and cons of each.

Because this is an uni assignment, I do not wish for anyone else to do the work for me (that is my job) but what I was looking for was a possible number of sources that are already in existence; including people's views on existing Linux based workflow to conduct a forensic examination of a Windows PC. One example here would be to contrast between Encase or FTK vs dd, dcvldd etc…

So, if you have experience of both workflows and in particular the 'batting order' of tasks within Linux, then I would be keen to discuss your views, any reference sources and then conduct my own experiments to validate and propose a Linux based examination methodology and workflow.

Hope this is not too detailed.

Cheers,

And, to further nitckpicking, one primary F/OSS monetizing solution is paid support.

"paid, no support" is more of a commercial venture. mrgreen

But, we digress as usual.

… it is usually more of a matter of if you prefer opens source or paid support.

To be picky (as I actually am) there are also cases of "paid, no support" 😯

jaclaz