|
Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com |
Re: [Full-disclosure] Forensic help?
From: Paul Robertson (compuwar
gmail.com)
Date: Fri Sep 16 2005 - 13:05:25 CDT
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On 9/12/05, Nick FitzGerald <nickvirus-l.demon.co.uk> wrote:
> Anyway, much as I am an _only very occasional_ user of Ghost, I don't
> think I've ever used it NOT to make a sector-level, or raw disk image,
> style drive copy. However, as I last used it so long ago, I decided to
> check I was not mis-remembering -- two seconds at Google turned up this
> URL discussing "...the Ghost switches to use for forensic imaging or
> for creating raw images (sector copies)..." (URL may wrap):
>
> http://service1.symantec.com/SUPPORT/ghost.nsf/docid/2001111413481325?Op
> en&src=&docid=19
G'day Nick,
While you *can* use Ghost to get a complete image, the switches change
from version to version and it's really a PITA to test what does what
when. Most folks I know if the field have decided there's too much
room for error with Ghost. Also, it means more to document, which is
bad for the lazy ;).
Paul
--
www.compuwar.net
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]