From: Clint P. Garrison MBA, CISSP, QSA (garrison.clint@gmail.com)
Date: Tue Apr 10 2007 - 23:28:18 EDT
I have Two recommendations;
1. The boot from CD option should be enabled/disabled in the BIOS.
Enable "boot from CD" and boot off of a Forensics Boot CD. I recommend
Helix. If the BIOS is password protected, go to 2...
2. Take the hard drive out and use the Forensics CD, or a Linux system
(dd), to make a copy of the disk from another system. Then analyze the
copy. Short of Full Disk encryption, that will circumvent the
third-party software.
Last...Why isn't this "employee" violating any policies? It sounds
like you should take a hard look at your Computer Security Policies...
Later,
Clint P. Garrison
MS, MBA, CISSP, QSA
On 4/10/07, Mifa <mifa@stangercorp.com> wrote:
> We have a user who takes a company computer home with them (no its not a lap top). We have a good reason to need to look at their files. However, we want to do so without that employ knowing. They seem to know something about security becasue auto runs is disabled and the workstation is always locked with a third party software. INserting a U3 drive will not run a program either. Are there any programs that will boot from a floppy then copy a program to the c drive then wite an auto start entry into the registry? This was the only way I can think of to get the user to install a program..
>
> Any other ideas how we maight gain access? It has to be fast (bathroom breaks ect). I dont have time to load a live cd. Further, robooting would cause the user to loose work.
>
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
>
> http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
> ------------------------------------------------------------------------
>
>
------------------------------------------------------------------------
This List Sponsored by: Cenzic
Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:42 EDT