Ethical Hacking Training at InfoSec Institute Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Minimal RAM footprint boot CD? |
|---|---|
| Date: | Wed, 15 Jun 2005 23:49:27 -0400 (EDT) |
Hi, all. I was using dd under Helix 1.6 to make an image of a (very) damaged hard drive... after several days, I had copied some 3 GB out of 40, while most of the time was spent trying to copy the other 1100 or so bad sectors. The important part to me, at this point, was the log file of where dd found errors (I was redirecting stderr to a logfile); naturally, this file was stored in RAM (only one USB port and no floppy). Anyway, it was chewing along, albeit slowly, when I went to bed one night; imagine my surprise and dismay when in the next morning, the CD was ejected and Helix was prompting me for a reboot. Yikes! Where is my logfile? Ever so temptingly stranded in RAM.... [I'm mystified about how this happened; obviously, it didn't lose power and I sure never initiated a shutdown.... But that's an issue for another time.] It's still sitting at that "remove CD" prompt. I figure if I boot from CD with a small memory footprint, I stand a very good chance of finding the logfile data in RAM. Maybe an old version of DOS with DEBUG (ugly, but functional). Or I could write a minimalist COMMAND.COM replacement in assembler. But it would be a lot nicer if there were some prior art, and if it had the capability to mount USB drives (or burn to CD) and write files, instead of just sectors... My guess is that (old) DOS will use less RAM than any existing Linux. Obviously, it is critical that RAM not be zeroed. Google has given some tips, but I figured I would tap the expertise here. If you reply directly and there is interest, I'll be pleased to summarize to the list. Thanks! -BPB University of Michigan AntiVirus Team Leader University of Michigan Data Recovery Team Leader PGP 2.6.2 key fingerprint: 0D A5 98 3C 91 DA E0 DD 9C 6D FA 8F 4D 34 95 ED
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | RE: Carving deleted messages from PST file remains, Greg Kelley |
|---|---|
| Next by Date: | Re: Minimal RAM footprint boot CD?, Volker Tanger |
| Previous by Thread: | Tools accepted by the courts, Robert Larson |
| Next by Thread: | Re: Minimal RAM footprint boot CD?, Volker Tanger |
| Indexes: | [Date] [Thread] [Top] [All Lists] |