On Mon, 2004-01-26 at 13:35, Don Calfa wrote:
> Is there a floppy based distro with ntfs drivers that I can use to get 
> into this thing with?

Here is a list from freshmeat.net:
http://freshmeat.net/browse/1013/

Another idea might be to remove the hard drive and mount it (read-only)
on another box somewhere.  You might need an adapter to connect a
standard IDE cable to the tiny laptop hard drive (trip to Fry's).

For example, assuming the laptop drive is addressed by the booting
kernel as /dev/hdb and the interesting partitions are hdb1 and hdb5
(adjust accordingly):

(Use `dmesg | grep hd` to see the HD enumeration)
(Use `fdisk /dev/hdb` to see the partitions, press command 'p')

# mount /dev/hdb1 /mnt/w2k/hdb1
# mount /dev/hdb5 /mnt/w2k/hdb5
# cp -R /mnt/w2k/ /root/evidence/
# umount /dev/hdb1
# umount /dev/hdb5

Better yet, don't mount it, just dd it to an image file on another disk,
then mount the image file read-only on a loop device so you can examine
it without changing anything.

# dd if=/dev/hdb1 of=/root/evidence/hdb1.img
# dd if=/dev/hdb5 of=/root/evidence/hdb5.img
Shutdown and put the laptop hard drive in a safe..

Then, to examine:
# mount -o ro,loop /root/evidence/hdb1.img /mnt/evidence/hdb1
# mount -o ro,loop /root/evidence/hdb5.img /mnt/evidence/hdb5
# cd /mnt/evidence

Hope that helps,
...Kevin