Re: [Full-Disclosure] Imaging Operating Systems

2004-05-28 Thread Volker Tanger
Greetings! On Thu, 27 May 2004 19:27:09 +0200 Maarten [EMAIL PROTECTED] wrote: Mmmm... answered my own question with a bit of googling, sorry... But it may be helpful or useful in this thread too, so here goes: [...] Surely not comparable to Ghost, but with no extra effort or cost...

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-28 Thread Phillip R. Paradis
Ghost won't work (IIRC) on unknown OS types as it ony copies used data blocks. Netcat does a binary copy and does not care what OS or data... Not sure about newer versions of Ghost, but I know some older versions will copy unknown partition types just fine; it merely does a bitwise copy of

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-28 Thread Nick FitzGerald
Volker Tanger [EMAIL PROTECTED] wrote: Ghost won't work (IIRC) on unknown OS types as it ony copies used data blocks. Netcat does a binary copy and does not care what OS or data... That just might be a limitation if you are GUI-bound, but I'm sure there are (or, at least were on the most

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-28 Thread Frank Knobbe
On Fri, 2004-05-28 at 10:14, Curt Purdy wrote: You are right about vmWare. It is THE most usefull tool for lab work I've found. When you are through trashing a virtual OS, just delete it and copy over the original folder that you initially backed up and you're good to go again. Why so

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Ondrej Krajicek
Microsoft is currently offering VirtualPC (formerly Connectix, similar to VMWare) and they have a beta programme for their upcoming Virtual Server (server-oriented VirtualPC). Also, for servers, they have a Advanced Deployment Services. Ondra On Wed, May 26, 2004 at 03:53:03PM -0500, Shawn Cox

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Nick FitzGerald
Michael Schaefer [EMAIL PROTECTED] wrote: We are building a Windows test system, to try out tool bars, spy ware, malware and trojans on. Once we learn what we need to know, we obviously want to get rid of the junk quickly and cleanly. I keep hearing suggestions about having a clean image

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Chmielarski TOM-ATC090
Of James Riden Sent: Wednesday, May 26, 2004 4:24 PM To: [EMAIL PROTECTED] Cc: Full-Disclosure Subject: Re: [Full-Disclosure] Imaging Operating Systems Michael Schaefer [EMAIL PROTECTED] writes: Hi all We are building a Windows test system, to try out tool bars, spy ware, malware and trojans

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Maarten
On Thursday 27 May 2004 16:09, Nick FitzGerald wrote: Michael Schaefer [EMAIL PROTECTED] wrote: We are building a Windows test system, to try out tool bars, spy ware, malware and trojans on. Once we learn what we need to know, we obviously want to get rid of the junk quickly and

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Maarten
On Thursday 27 May 2004 18:30, Kevin Connolly wrote: Maarten wrote: This is an interesting thread... But out of curiosity, is it also possible to do backup / restores using readily available linux tools? I'd like to be able to do something like running dd over a network connection, or

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Kevin Connolly
Maarten wrote: This is an interesting thread... But out of curiosity, is it also possible to do backup / restores using readily available linux tools? I'd like to be able to do something like running dd over a network connection, or tar, or whatever other tool. In that case, a bootable CD is

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Ondrej Krajicek
This is an interesting thread... But out of curiosity, is it also possible to do backup / restores using readily available linux tools? I'd like to be able to do something like running dd over a network connection, or tar, or whatever other tool. In that case, a bootable CD is all you

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Glenn_Everhart
if you create partitions in Windows (or maybe an old Linux off CD) the partition table gets written somehow. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Maarten Sent: Thursday, May 27, 2004 12:59 PM To: Full-Disclosure Subject: Re: [Full-Disclosure] Imaging

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Williams Jon
is Knoppix-based, this might do what I think you're looking for. Jon -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Maarten Sent: Thursday, May 27, 2004 11:59 AM To: Full-Disclosure Subject: Re: [Full-Disclosure] Imaging Operating Systems On Thursday 27 May

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-27 Thread Epic
In a large telemarketing company I used to I.T. for, we ran across Deep Freeze. (http://www.faronics.com/) This product allowed pretty much any changes to be made to the machine including customizations, deletions, and propagation of virus / worms, without harm to the machine. In fact all it

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Charles Schmidt \(CSIS\)
Hi Michael, there are a number ways to create testing environments with clean images. I have built a few corporate test labs and would be happy to help you build one. Microsoft's sysprep used to be the only working way to reproduce clean automated installs (and the only supported). Lately I have

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Shawn Cox
Norton/Symantec Ghost PowerQuest Drive Image(I think Norton gobbled this one up) Or for the truly crafty vmWare. --S - Original Message - From: Michael Schaefer [EMAIL PROTECTED] To: Full-Disclosure [EMAIL PROTECTED] Sent: Wednesday, May 26, 2004 1:55 PM Subject: [Full-Disclosure]

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread James Riden
Michael Schaefer [EMAIL PROTECTED] writes: Hi all We are building a Windows test system, to try out tool bars, spy ware, malware and trojans on. Once we learn what we need to know, we obviously want to get rid of the junk quickly and cleanly. I keep hearing suggestions about having a

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread S G Masood
--- Shawn Cox [EMAIL PROTECTED] wrote: Norton/Symantec Ghost PowerQuest Drive Image(I think Norton gobbled this one up) Or for the truly crafty vmWare. Yeah. And do remember that though VMware is the platform of choice for many testlabs, malware can change its behaviour when it detects

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Lachniet, Mark
Any reason not to just use Ghost? Also, some people use VMWARE, and make a clean VMWARE image, copy it, load the suspicious stuff, and then delete it afterwards. If you have your virtual network interfaces disabled, it may be a fairly safe sandbox to work in. Mark Lachniet -Original

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Lionel Hendricks
Ghost or just image the drive. ||-Original Message- ||From: [EMAIL PROTECTED] [mailto:full-disclosure- ||[EMAIL PROTECTED] On Behalf Of James Riden ||Sent: Wednesday, May 26, 2004 5:24 PM ||To: [EMAIL PROTECTED] ||Cc: Full-Disclosure ||Subject: Re: [Full-Disclosure] Imaging Operating Systems

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread vertex
How about using VMWARE, building your windows system in a virtual machine, then using the snapshot to snapshot your initial clean system, then you can install the malware etc and test, while you want the clean system, just revert it to the clean system. -vertex On Wed, May 26, 2004 at

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Perrymon, Josh L.
: Wednesday, May 26, 2004 4:24 PM To: [EMAIL PROTECTED] Cc: Full-Disclosure Subject: Re: [Full-Disclosure] Imaging Operating Systems Michael Schaefer [EMAIL PROTECTED] writes: Hi all We are building a Windows test system, to try out tool bars, spy ware, malware and trojans on. Once we learn what

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Sam Sharpe
On 26 May 2004, at 19:55, Michael Schaefer wrote: I keep hearing suggestions about having a clean image to transfer onto the computer. Is there an official Microsoft way to do this? two methods: 1) Unattended Install (link is for a CD based version, we do it from a network install server)

RE: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread Zach Forsyth
Cox Sent: Thursday, 27 May 2004 6:53 AM To: [EMAIL PROTECTED]; Full-Disclosure Subject: Re: [Full-Disclosure] Imaging Operating Systems Norton/Symantec Ghost PowerQuest Drive Image(I think Norton gobbled this one up) Or for the truly crafty vmWare. --S - Original Message - From: Michael

Re: [Full-Disclosure] Imaging Operating Systems

2004-05-26 Thread defiance
There are also some open source alternatives, mondo/mindi udpcast I use a modified version of udpcast put on a knoppix disk to do big network installs.We keep a small 6gb image on a image server and then the knoppix disk will transfer the image and resize the partitions based upon the size of the