Booting Disk Images in Linux
Booting Disk Images in Linux A Picture can be Worth a Thousand Words Sometimes there is no substitute for booting a computer to gather data. But the forensic consequences of directly booting the system under investigation are prohibitive. And, while it can be possible to restore a computer image to another hard drive and install that drive in the computer hard drive for booting, this can be costly, very time consuming, and you only get one shot before youve changed the data from original (and repeated boots may be desirable depending on the investigation). In response to this, tools like LiveView were created. The concept was to boot the forensic image, rather than restore it, and capture all system changes in a disk cache. The operating system could be booted quickly and repeatedly from an original state. However, I never found LiveView to be very effective, and it the past few years I have avoided Windows-based tools whenever possible . En...