Tag Info

Hot answers tagged

6

dd. Take an image of your compromised machine, then wipe it and start over. You cannot trust anything your host is telling you any more. Once you have said disk image though, the question is very much 'what do you want to accomplish'? If it's evidence/legal, then you're going to have to be incredibly careful, and probably want to consul a legal ...


2

On Windows 7, if UAC is enabled and you open Command Prompt with "Run as Administrator", you won't see the mapped drives either. On Windows 8, you'll notice that even when UAC is disabled, you still have to "Run as Administrator". The reason why Administrator doesn't see the mapped drives is explained in the Technet article you linked. In a nutshell, you ...


1

I haven't tried this but you might be able to mount the "E01" image with Encase imager (also free) and if it does the same as the FTK Imager mounting, you can mount as physical and logical (or just physical is all that is necessary). I am guessing a bit, since Guidance and Accessdata are competitors in the market, and FTK Imager has mounting capability, ...



Only top voted, non community-wiki answers of a minimum length are eligible