Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20102

General Discussion: find out if user booted from CD

$
0
0
digitalcoroner wrote: Do you mean manually carving? If yes, would you have an example on how to do this? Search the disk in a hex editor (especially in unallocated areas) for signatures characteristic to ISO boot images. Can't give you an example, but you can download several bootable ISO images and quickly discover what's in common to all of them.

Viewing all articles
Browse latest Browse all 20102

Trending Articles