Tag Info

Hot answers tagged

6

dd. Take an image of your compromised machine, then wipe it and start over. You cannot trust anything your host is telling you any more. Once you have said disk image though, the question is very much 'what do you want to accomplish'? If it's evidence/legal, then you're going to have to be incredibly careful, and probably want to consult with a legal ...


6

This question's on its way to getting closed as a duplicate of How do I deal with a compromised server, and I think that's a mistake, because the very correct advice in that question is to nuke the server and restore from known-good media. However, there's absolutely no evidence that this system has been compromised. OsakaWebbie, you have admitted that you ...


1

I'm going to largely C&P an answer of mine from an unrelated question. This is a better home for it I think. The instructions below are provided with the assumption that you have already followed the instructions for How do I deal with a compromised server? if applicable. Always disconnect the network cable when in doubt. find /filesystem1 /filesystem2 ...


1

I haven't tried this but you might be able to mount the "E01" image with Encase imager (also free) and if it does the same as the FTK Imager mounting, you can mount as physical and logical (or just physical is all that is necessary). I am guessing a bit, since Guidance and Accessdata are competitors in the market, and FTK Imager has mounting capability, ...



Only top voted, non community-wiki answers of a minimum length are eligible