Ethical Hacking Training at InfoSec Institute

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Computer Forensics Computer-Forensics
[Top] [All Lists]

Minimal RAM footprint boot CD?

Subject: Minimal RAM footprint boot CD?
Date: Wed, 15 Jun 2005 23:49:27 -0400 (EDT)
Hi, all.

   I was using dd under Helix 1.6 to make an image of a (very) damaged
hard drive... after several days, I had copied some 3 GB out of 40, while
most of the time was spent trying to copy the other 1100 or so bad
sectors. The important part to me, at this point, was the log file of
where dd found errors (I was redirecting stderr to a logfile); naturally,
this file was stored in RAM (only one USB port and no floppy).

   Anyway, it was chewing along, albeit slowly, when I went to bed one
night; imagine my surprise and dismay when in the next morning, the CD was
ejected and Helix was prompting me for a reboot.  Yikes!  Where is my
logfile?  Ever so temptingly stranded in RAM....

   [I'm mystified about how this happened; obviously, it didn't lose power
and I sure never initiated a shutdown....  But that's an issue for
another time.]

   It's still sitting at that "remove CD" prompt.

   I figure if I boot from CD with a small memory footprint, I stand a
very good chance of finding the logfile data in RAM.  Maybe an old version
of DOS with DEBUG (ugly, but functional).  Or I could write a minimalist
COMMAND.COM replacement in assembler. But it would be a lot nicer if there
were some prior art, and if it had the capability to mount USB drives (or
burn to CD) and write files, instead of just sectors...  My guess is that
(old) DOS will use less RAM than any existing Linux.

   Obviously, it is critical that RAM not be zeroed.

   Google has given some tips, but I figured I would tap the expertise
here.  If you reply directly and there is interest, I'll be pleased to
summarize to the list.

   Thanks!

   -BPB

University of Michigan AntiVirus Team Leader
University of Michigan Data Recovery Team Leader
PGP 2.6.2 key fingerprint:  0D A5 98 3C 91 DA E0 DD  9C 6D FA 8F 4D 34 95 ED

<Prev in Thread] Current Thread [Next in Thread>