RE: Windows HD image for forensics testing

From: Altheide, Cory B. (AltheideCat_private)
Date: Mon Jul 14 2003 - 14:13:19 PDT

Next message: Mark G. Spencer: "Possible remnants of wiping .. Solved!"

Previous message: Jason Powell: "Re: Windows HD image for forensics testing"
Maybe in reply to: Job 317: "Windows HD image for forensics testing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I don't think that you'll find such a beast, thanks to commercial licensing.

Anyone posting a Windows drive image is, in effect, illegally distributing
copyrighted material, and will likely be ripped to shreds hounds of the BSA
posthaste.

If you want to practice on Windows images, you'll have to set up a Windows
honeypot yourself.

Cory Altheide
Computer Forensics Specialist
NNSA Cyber Forensics Center
altheidecat_private

> -----Original Message-----
> From: Job 317 [mailto:job317at_private] 
> Sent: Monday, July 14, 2003 11:13 AM
> To: forensicsat_private
> Subject: Windows HD image for forensics testing
> 
> 
> Does anyone know of a web site where I can download a Windows 
> (any flavor but preferably NT/2000/XP Pro) hard drive 
> image/partition in order to do some forensics testing. I 
> looked at the forensics challenge images for the Redhat 6.2 
> system from honeynet.org but I would like to try a Windows image now.
> 
> Thanks,
> 
> Job
> 


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Next message: Mark G. Spencer: "Possible remnants of wiping .. Solved!"
Previous message: Jason Powell: "Re: Windows HD image for forensics testing"
Maybe in reply to: Job 317: "Windows HD image for forensics testing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Mon Jul 14 2003 - 14:57:32 PDT