Help: Disk signature

From: Dmitry Tsurlik (dtsrlat_private)
Date: Wed Feb 06 2002 - 01:32:35 PST

Next message: Settle, Sean: "Exchange/MAPI message origin"

Previous message: Paul Sanderson: "Protected disk areas can defeat disk imaging software"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Analyzing several HDD from suspect computers I"ve found 8 
byte signature on some of them. It"s located at offset 0xC0 
in last sector (63) of track 0, cylinder 0. The first two 
bytes are always "GH" (0x47 0x48), the next two bytes are 
either  "DD" (0x44 0x44) or "PP" (0x50 0x50), the last 4 
bytes looks like a timestamp.
Has anybody seen anything similar? Could it have been left 
by Symantec Ghost?

Thanks

Dmitry Tsurlik


__________
www.newmail.ru -- всегда что-то новое.

-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Settle, Sean: "Exchange/MAPI message origin"
Previous message: Paul Sanderson: "Protected disk areas can defeat disk imaging software"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Wed Feb 06 2002 - 12:36:36 PST