Do any other live cd's boot and run? Or have any previous versions of helix
worked? The latest is 1.8 on 10-06-06. Do you have an old copy laying about?
If it boots, it should be able to mount the ram drive as long as the target
machine is working properly. If it cant, it should identify the error in the
screen dump in some fashion, at least point to the halt point, yes?
-----Original Message-----
From: Erik Luken [mailto:eluken@pentarch.org]
Sent: Wednesday, May 30, 2007 7:58 PM
To: ragdelaed; security-basics@securityfocus.com
Subject: Re: Forensic tool to recommend?
By limited usage, I mean next to none. The cd would boot, but not mount any
ram-drives to do the tests.
Now that I think about it, I'm not sure if it was the SATA CD or HDD that
was causing this. I'll have to check again.
----- Original Message -----
From: "ragdelaed" <ragdelaed@gmail.com>
To: "'Erik Luken'" <eluken@pentarch.org>;
<security-basics@securityfocus.com>
Sent: Wednesday, May 30, 2007 6:52 PM
Subject: RE: Forensic tool to recommend?
I would think you wanted read only if you were conducting a forensic
examination, right? Or am I reading this wrong?
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On
Behalf Of Erik Luken
Sent: Wednesday, May 30, 2007 3:58 PM
To: security-basics@securityfocus.com
Subject: Re: Forensic tool to recommend?
Biggest issue I've noticed here, is that Helix does not recognize SATA
cdroms. Booting from such, you get a limited read-only usage.
----- Original Message -----
From: "Richard Lane" <lane.security@gmail.com>
To: <security-basics@securityfocus.com>
Sent: Wednesday, May 30, 2007 7:55 AM
Subject: Re: Forensic tool to recommend?
I recommend the HELIX LiveCD distro. It has both Windows and Linux "sides"
- booting from cold will give access to the Linux toolset, however loading
the CD in Windows provides access to a variety of Windows tools.
http://www.e-fense.com/helix/
Good luck
Richard
From: Fabio Cerullo <fcerullo_at_gmail.com>
Date: Tue, 29 May 2007 07:53:28 +0100
Hi All,
I am evaluating some tools for gathering evidence in Linux and Windows
distros.
In particular I am interested in recovering files/folders which have
been deleted "accidentally" from the PC.
I am aware there are some Live CD's with Linux installed that could
mount a drive and try to recover those files but don't know anyone in
particular.
Any help will be really appreciated.
Thank you very much.
Greetings,
Fabio
