What about using something like Norton Ghost and saving the ghost image to a CD or DVD or something along those lines? As long as the physical chain of custody was kept of course. Tyler -----Original Message----- From: Meritt James [mailto:meritt_jamesat_private] Sent: Friday, May 03, 2002 9:05 AM Cc: FORENSICSat_private Subject: Preserving evidence While a disk duplication and then work on the dupe is preferred, what is the legal status with respect to evidence of doing a full backup to tape (with witnesses, using a standard product, sealing the tape afterwards appropriately, ..) then working on the original? I'm thinking of the resources at hand for some of the smaller sites. Alternatives? -- James W. Meritt CISSP, CISA Booz | Allen | Hamilton phone: (410) 684-6566 ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Mon May 06 2002 - 06:29:47 PDT