As for "free" options, there was a diskedit program that came inside sp4 for Windows NT 4.0. It had an MFT walker. For what it's worth, I've found the disk editors at www.runtime.org cost effective and very close in function to the old Norton diskedit (and they run in Windows). I use them all the time to make the same repairs I used to make with the Norton product. I know it understands the MFT as well. Michael Burnette Rogers & Hardin LLP Atlanta, GA -----Original Message----- From: Steve Hailey [mailto:shaileyat_private] Sent: Thursday, April 17, 2003 9:02 PM To: 'forensicsat_private' Subject: Diskedit I have several students in my Introduction to Computer Forensics class that would like additional material and exposure on using the old Norton Diskedit. I'd appreciate any information that my fellow examiners and/or instructors could provide, such as URL's or recommendations on books. We use the program to teach basics of how information is stored when using FAT, as well as how to use some of the basic features for forensic examinations. I'd also love to hear how any of you are using this old workhorse of a program. As well, any good tools out there for viewing the MFT under NTFS? Steve Hailey www.btc.edcc.edu <http://www.btc.edcc.edu> ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com This message and any attachments are intended for the use of the addressee(s) only and may be confidential and covered by the attorney/client and other privileges. If the reader is not the intended recipient, DO NOT READ, notify sender and delete this message. In addition, be aware that any disclosure, copying, distribution or use of the contents of this message is strictly prohibited. ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Tue Apr 22 2003 - 06:06:31 PDT