Dear all,
I am trying to create a WinFE Boot Disk which I have achieved, however, when booting into the WinFE environment, all the internal disks' statuses are 'online' according to DISKPART.
What I would like to achieve is for the internal (source) disks of the machine that I want to image upon booting into WinFE to be offline instead.
I have followed online guides and have changed the SanPolicy to '4' within Partmgr\Parameters which should ensure this, but this doesn't seem to have the desired effect.
Does anyone know how to solve this?
I would like to achieve this because my understanding is (please correct me if I am wrong here) that when it comes to imaging and if the selected internal source disk is online, then the pre and post acquisition hashes won't match. This is coincides with test imaging that I have conducted with X-Ways Forensics whereby the acquisition and post acquisition hash did not match.
Hope to hear from someone soon.
Thank you.
Please follow the steps described in the article i published here at Forensic Focus
https://articles.forensicfocus.com/2017/01/06/windows-10-pe-for-digital-forensics/
I only worked with SanPolicy 1 and 3. 3 does not touch anything and does not write a boot record.
best regards,
Robin
Thank you!!