Image a drive?

  • Thread starter Thread starter HotRod
  • Start date Start date
H

HotRod

I want to image a computer without installing any software, is there
something available that will not leave a trace of me imaging the machine?
 
HotRod said:
I want to image a computer without installing any software, is there
something available that will not leave a trace of me imaging the machine?
Click to expand...
Ghost
 
I want to image a computer without installing any software, is there
something available that will not leave a trace of me imaging the machine?
Click to expand...

If you know that computer well, you may try to Ghost it via PXE / boot CD /
boot Floppy to a remote network share.
 
Which Ghost? Ghost 9.0 requires the installation of .NET
Framework.

Ghost 8.2, 8.0, 7.5 ...maybe 2003
 
HotRod said:
I want to image a computer without installing any software, is there
something available that will not leave a trace of me imaging the machine?
Click to expand...

Yes, True Image can do that from the rescue CD. Writing the image
to anywhere you like, USB2/firewire drive, across the lan etc.
 
Timothy said:
Will Ghost 2002 work for Windows XP?

*TimDaniels*
Click to expand...

I don't think it cares about the OS, just the file system.

Of those, it does FAT, NTFS, and EXT2 according to the
documentation; no guarantees from me.

I've never tried it on a disk over 128GB -- I suspect it might
have issues.
 
I want to image a computer without installing any software, is there
something available that will not leave a trace of me imaging the machine?
Click to expand...
If it's for non-forensic applications, TI8 from the boot disk is
probably the best bet, as has been stated.

For forensic purposes (like needing to have the unused space imaged as
well), and especially for legal purposes, there are programs
specifically designed for that, like EnCase, FTK, SMART, or dcfldd.

The evidentiary chain procedures become as important as the technique
used for those cases.
 
Back
Top