RE: Imaging a "live" system

From: Christopher L. T. Brown (clbrownat_private)
Date: Wed Jun 19 2002 - 10:01:58 PDT

  • Next message: Bill Royds: "RE: Imaging a "live" system"

    > Even with really high data transfer rates it's going to take 
    > a good 20 
    > mins to take the image of that system, in that time the 
    > active users on 
    > the system will have written data to the drive, and the OS will also 
    > have written data to the drive (logs etc).  The image of the 
    > system that 
    > you end up with probably isn't going to be worth much as I 
    > would suspect 
    > that large amounts of the data will be corrupt as, by the 
    > time that the 
    > data in the last third of the drive is imaged its content, 
    > and layout, 
    > will have changed to the point whereby it no longer matches 
    > up with its 
    
    Craig,
    Good points here. One thing to take into account for high availability
    servers is rarely is the storage as simple as a single hard disk or even
    a RAID set. These days many will be using Network Attached Storage or
    Storage Area Networks. Many of the NAS and SAN devices I've worked with
    have the ability to create complete "snapshots" in time.   
    
    Christopher L. T. Brown
    Technology Pathways LLC
    Makers of ProDiscover DFT
    clbrownat_private
    Phone: 619-435-0906
    http://www.TechPathways.com
    
    
    
    -----------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Wed Jun 19 2002 - 16:22:59 PDT